CERT Recently Published Vulnerability Notes - TheNote.app

CERT Recently Published Vulnerability Notes
Follow

kb.cert.org/vuls is a webpage maintained by the Carnegie Mellon University Software Engineering Institute (SEI) which provides a publicly accessible database of known software vulnerabilities. It lists a vast amount of vulnerability information including identifiers, descriptions, severity ratings, and potential impacts, helping users stay informed about potential security risks.

CERT Recently Published Vulnerability Notes kb.cert.org

RSS kb.cert.org

RSS Hunter • Aug 19, 2024

Thread Of Notes

VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic

BoringSSL has identified five issues related to how certificate name constraints are applied to Subject Alternative Names. These findings concern the legacy crypto/x509 path and the newer pki path within BoringSSL. Two of the vulnerabilities, VU#410595.8 and .12, concerning wildcard DNS names and trailing-dot DNS names respectively, have been fixed. VU#410595.9, related to URI constraints and colons before '@', has been accepted and is under coordination. VU#410595.10, regarding first-@ domain extraction in rfc822Name matching, remains disputed due to unclear exploitation potential. VU#410595.11, concerning trailing-dot handling in rfc822Name domains, was declined by the BoringSSL team as it was deemed below their security threshold. The impact of these issues is limited to scenarios where name constraints are enforced, trusted signatures are obtainable over attacker-controlled SAN fields, and the accepted name is used for authorization. The presence of BoringSSL in a product does not automatically imply that the product is affected, as specific paths and name forms must be invoked. Fixes for the vulnerabilities are applied through BoringSSL's upstream repository and subsequently integrated into products via their update mechanisms. Operators are advised to verify if their deployments use affected paths, apply available updates, and ensure that issued SANs are well-formed to mitigate potential risks.

https://kb.cert.org/vuls/id/410595 kb.cert.org

RSS Hunter • Oct 14

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

This document details thirteen library-specific records concerning the implementation of X.509 Name Constraints. These records highlight inconsistencies in how various TLS libraries handle these constraints, leading to situations where a name accepted by one library might be rejected by another. Some of these issues have been resolved, while others are still under review or were not deemed security vulnerabilities. Name Constraints are designed to confine Certificate Authorities (CAs) within a defined namespace. Discrepancies exist in handling DNS name case sensitivity and wildcard matching, with libraries like GnuTLS and Go exhibiting varied behaviors. pyca/cryptography was found to validate constraints against SANs but not against the requested peer name. Libraries also differ in how they treat IPv4 and IPv6-mapped IPv6 forms for IP address constraints. URI handling presents further inconsistencies, particularly regarding host extraction from URI SANs. AWS-LC and s2n-tls have reported issues with wildcard Common Name fallback when leaf certificates lack SANs. Mbed TLS, in a specific configuration, does not enforce non-critical Name Constraints, contrary to RFC 5280 requirements. The impact of these inconsistencies is relevant only when an attacker can forge a trusted signature and exploit a validation path for authorization. CERT/CC is coordinating remediation efforts with affected projects, with varying statuses reported for each library. Operators relying on Name Constraints are advised to verify their libraries' behavior and prioritize explicit SANs and issuance policies.

https://kb.cert.org/vuls/id/948176 kb.cert.org

RSS Hunter • Oct 14

VU#166125: Bisheng has authentication bypass vulnerabilities

Bisheng, an open-source LLM DevOps platform, suffers from three critical vulnerabilities. A pre-authentication account takeover is possible through a legacy Single Sign-On (SSO) endpoint. This flaw allows attackers to create accounts with administrative privileges by bypassing proper authentication mechanisms. An Insecure Direct Object Reference (IDOR) vulnerability exposes cross-user workflow data, enabling any authenticated user to access sensitive configurations of others. Additionally, prior to version 2.5.0, authenticated users could abuse LLM credentials and disclose data due to missing access checks. These issues collectively allow unauthenticated attackers to gain administrative control. Authenticated users can exploit these flaws to access sensitive information and hardcoded credentials. The IDOR and credential abuse vulnerabilities have been patched in versions 3.0.0 and 2.5.0 respectively. However, the legacy SSO bypass vulnerability remains unpatched. Mitigation strategies for the SSO flaw include avoiding specific environment configurations and disabling or securing the legacy SSO endpoint. Restricting network access to this endpoint is also recommended.

https://kb.cert.org/vuls/id/166125 kb.cert.org

RSS Hunter • Oct 14

VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Periphery, an agent for the Komodo server management platform, has a critical vulnerability in versions up to 2.2.0. This vulnerability lies in the improper validation of container names, allowing OS command injection. Attackers can exploit this through container destruction or container log searches. By providing a specially crafted container name, an authenticated attacker can execute arbitrary commands as the root user. This compromise grants persistent control over the underlying host system. Komodo is an open-source server and deployment manager used in self-hosted and Docker multi-server setups. Periphery is the agent that allows Komodo to manage Docker environments on these servers. The vulnerability arises because container names are directly inserted into shell commands without proper escaping or validation. These commands, executed with Periphery's root privileges, provide a direct pathway for exploitation. The impact is significant, enabling attackers to gain root access, establish persistence, and compromise the entire managed infrastructure. Fortunately, Komodo has released a patch for this issue, with versions 2.3.0 and above being secure. Users are strongly advised to update their Komodo installations immediately to mitigate this risk.

https://kb.cert.org/vuls/id/456950 kb.cert.org

RSS Hunter • Oct 13

VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Lowcoder version 2.4.10 has an authorization bypass vulnerability in its Query Library feature's API. This flaw allows authenticated users with admin or dev roles to access private query data from other organizations in a multi-tenant instance. The vulnerable API endpoints for metadata retrieval and query execution fail to check if the requested resource belongs to the user's organization. While role-based access is present, it only validates the role against the user's own organization.An attacker with admin or dev privileges in any organization can view the full DSL of other organizations' library queries. They can also execute any library query on the instance, receiving data directly from the affected organization's backend. This can lead to cross-tenant data exposure, modification, or destruction. Additionally, attackers could cause cost abuse by querying paid data sources using another tenant's resources. The vulnerability violates data isolation between organizations.Unfortunately, Lowcoder has not been reachable to coordinate a fix for this issue. Administrators are advised to restrict access to the affected API endpoints and limit application access to trusted users. Reviewing admin and dev role assignments is also recommended. For multi-tenant deployments, isolating tenants into separate instances offers broader protection. If source-code modification is possible, implementing organization-level authorization checks for these API calls is crucial.

https://kb.cert.org/vuls/id/382143 kb.cert.org

RSS Hunter • Oct 13

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

TLS libraries exhibit varying interpretations of X.509 Name Constraints, leading to certificate acceptance or rejection inconsistencies. These differences arise from implementation defects and areas not fully specified by RFC 5280. Specifically, disparities exist in how DNS name comparison handles case sensitivity. IP address handling also differs, particularly regarding IPv4-mapped IPv6 addresses. URI-authority parsing presents inconsistencies in extracting the host when specific characters or components are present. Wildcard matching semantics for Subject Alternative Names are not clearly defined, causing further divergence. Some issues are outright implementation defects, while others stem from the RFC's lack of explicit guidance. The impact of these differences is limited, requiring a combination of a compromised trusted signature, a vulnerable validation path, and an application using the identity for authorization. Mixed environments like service meshes or CDNs may encounter inconsistent certificate validation for the same certificate. CERT/CC is collaborating with affected TLS library projects to address these issues. Operators requiring high assurance should test their validators, apply updates, and use explicit Subject Alternative Names. Application-layer allow-lists and issuance policies can also help mitigate these differences.

https://kb.cert.org/vuls/id/573195 kb.cert.org

RSS Hunter • Oct 13

VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Shopware 6.7 has a stored cross-site scripting (XSS) vulnerability in its media upload feature. This flaw allows attackers to compromise administrator credentials and achieve remote code execution. The vulnerability stems from the media upload API accepting HTML files which are then served as text/html without proper security headers. An attacker with media upload privileges can upload a malicious HTML file containing JavaScript. If an administrator accesses the media file, their authentication token can be stolen. This stolen token allows the attacker unauthorized access to the Shopware Administration API. If the compromised administrator has extension management rights, the attacker can install malicious plugins. This can lead to arbitrary PHP code execution on the server. No patch is currently available from Shopware. Users can mitigate the risk by restricting media upload access or disabling HTML file uploads.

https://kb.cert.org/vuls/id/157374 kb.cert.org

RSS Hunter • Oct 13

VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Versions 2.6.0 and 2.6.1 of Thelia, an e-commerce platform, contain numerous security flaws. These vulnerabilities span file management, templating, module installation, and administrative functions. Exploits can lead to remote code execution, server-side template injection, and cross-site scripting. Some issues allow administrative users to upload malicious files, enabling code execution on the server. The store banner upload feature also has insufficient validation, allowing PHP files disguised as images to be uploaded. An open redirect vulnerability exists in the address creation workflow, allowing attackers to redirect users to malicious sites. Stored XSS vulnerabilities in the administrative interface permit JavaScript execution when affected pages are viewed. Username enumeration is possible due to differing error responses for invalid credentials. Reflected XSS can occur in Smarty templates by failing to escape double quotes. Email templates lack proper restriction of dangerous PHP functions, enabling arbitrary command execution. Module installation without validation allows the inclusion of malicious PHP code. Version 2.6.1 has path traversal and PHP code injection vulnerabilities in its translation editor, leading to remote code execution. An absolute path traversal in Smarty template handling enables server-side template injection and RCE. No patch is currently available, so users should restrict administrative access and disable file upload features.

https://kb.cert.org/vuls/id/162329 kb.cert.org

RSS Hunter • Oct 12

VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

A critical Out-of-bounds Write vulnerability exists in InsydeH2O IHISI software used by HP PC BIOS. This flaw allows a local attacker with OS kernel privileges to write to arbitrary physical memory. The vulnerability is exploitable because the vulnerable code runs in the highly privileged System Management Mode (SMM). Successful exploitation could enable an attacker to modify SMM-protected memory. This modification might lead to arbitrary code execution within SMM. The vulnerability enables reading or writing arbitrary physical memory, including System Management RAM (SMRAM). An attacker can trigger this vulnerability by issuing a Software SMI via I/O port 0xB2 with crafted CPU register values. The affected handler fails to validate parameters, allowing manipulation of memory addresses and data. Consequently, an attacker could achieve persistence by modifying SMRAM and potentially altering SMM execution. Users should consult HP's security bulletins to identify if their system is affected.

https://kb.cert.org/vuls/id/553437 kb.cert.org

RSS Hunter • Oct 1

VU#762428: Authlib library contains a signature‑verification bypass vulnerability

Authlib versions up to and including 1.7.2 have a critical signature-verification bypass vulnerability in JWS general JSON serialization. The deserialize_json function incorrectly accepts JWS objects with an empty signatures array. This allows attackers to bypass signature verification entirely. Consequently, unsigned data is treated as if it were legitimately signed by the library. Attackers can exploit this by providing forged content without needing any key material. This flaw impacts both direct JSON deserialization and string deserialization methods. The primary impact is the ability for attackers to forge arbitrary authenticated payloads. This can lead to authentication bypass and privilege escalation by injecting forged identity claims. Microservices relying on JWS for message integrity are also vulnerable to injection attacks. Systems using JWS for authorization can be tricked into accepting forged scopes or roles. At present, no official patch is available as the vendor could not be reached. Users should monitor Authlib's GitHub repository for a fix and update accordingly.

https://kb.cert.org/vuls/id/762428 kb.cert.org

RSS Hunter • Sep 28

VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Three cross-site scripting vulnerabilities have been identified in Readwise Reader for Android version 8.7.2. Attackers can exploit these flaws by creating malicious documents or metadata. Successful exploitation allows arbitrary JavaScript execution within the application's WebView. This could lead to the compromise of user data, including documents, credentials, and session tokens. CVE-2026-18311 affects header rendering due to insufficient HTML escaping of metadata fields like author and title. CVE-2026-18312 impacts WebView URL construction for X videos and iOS paywall messages due to improper URL metadata escaping. CVE-2026-18320 stems from a wildcard attribute rule in the article body sanitization allowing malicious SVG markup. These vulnerabilities enable stored XSS when documents are synchronized to Android devices. While the vendor has not been reachable, version 8.10.1 reportedly patches the sanitizer-wildcard issue. Users are advised to update the app and exercise caution with untrusted content.

https://kb.cert.org/vuls/id/699627 kb.cert.org

RSS Hunter • Sep 25

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

ViewSonic's vCast software, a component of ViewBoard smartboards, suffers from multiple critical vulnerabilities. These weaknesses can be exploited in sequence by an attacker to gain complete control of the device. The smartboards are commonly found in businesses and schools. vCast facilitates wireless connections between these Android-based devices and client applications. Three specific vulnerabilities affect unauthenticated endpoints within the vCast suite.One vulnerability allows remote attackers to steal JPEG screenshots of the screen content via specific API requests. Another flaw enables the triggering of unprivileged file installations by supplying a malicious APK URL to an exposed download endpoint. A third vulnerability permits remote attackers to inject arbitrary input into service endpoints through HTTP requests. By chaining these vulnerabilities, an unauthenticated attacker can execute arbitrary code on a vCast device without user interaction. This can lead to unauthorized access to displayed content and persistent installation of malicious applications. Exploited devices could also serve as a gateway for lateral movement on a connected network. ViewSonic has not yet been reached for comment or to coordinate a fix. Users are advised to apply firmware updates when available and isolate vCast devices on secure, separate networks. Monitoring network traffic for suspicious vCast connections is also recommended.

https://kb.cert.org/vuls/id/234131 kb.cert.org

RSS Hunter • Sep 24

VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability

Norwegian Cruise Line ships have door access controllers with an improper authentication vulnerability. These controllers are susceptible to replayed unique identifiers from RFID devices, allowing unauthorized entry. The affected card readers authenticate NFC credentials solely by verifying their static 7-byte UID. This UID is not secret and lacks cryptographic challenge-response capabilities, making it an unreliable authentication factor. Although keycards have memory blocks with serial numbers and signature-like values, the reader ignores this data. Relying only on the UID means the system is identifying rather than authenticating. Since there's no cryptographic exchange, any device capable of replaying or emulating UIDs can create a working duplicate. An attacker can capture a valid keycard's UID with brief physical proximity and an RFID reader. This UID can then be copied to a writable card, creating a counterfeit credential. These fakes will be accepted as genuine by the access control readers, granting unauthorized access. In some cases, these unauthorized entries may not be distinguishable from legitimate use. This poses a significant security risk to both ship operations and guest safety, especially concerning access to restricted areas. Currently, there is no vendor-provided solution, but users can employ RFID-blocking wallets or shielded sleeves to mitigate cloning risks. Wrapping cards in aluminum foil can also create a basic Faraday shield to limit signal transmission. Keeping cards at least 12 inches away from others can help prevent unwanted scans.

https://kb.cert.org/vuls/id/676317 kb.cert.org

RSS Hunter • Sep 24

VU#273940: Enterprise Access Management EAM does not rotate RSA keys

Imprivata Enterprise Access Management (EAM) versions 26.2.6 and below have a vulnerability. The platform uses an RSA key pair to generate its X.509 certificate for authentication. Crucially, there is no supported method to rotate this key pair after initial deployment. This means the same key is used indefinitely for certificate generation. Using a single, unchangeable key pair indefinitely is a significant departure from cryptographic best practices. If an attacker obtains the private key, they can indefinitely impersonate the EAM appliance. This impersonation allows the attacker to intercept authentication traffic, including credentials and SSO tokens for critical systems like EHRs. Previously captured encrypted traffic could also be decrypted retroactively if perfect forward secrecy is not enforced. Imprivata is aware of the issue and is reportedly working on a resolution. However, no fix or timeline has been released yet. In the interim, users should heavily restrict access to the appliance's private key, backups, and snapshots. Enforcing perfect forward secrecy on connections can also mitigate some of the impact.

https://kb.cert.org/vuls/id/273940 kb.cert.org

RSS Hunter • Sep 23

VU#754548: Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

Cinnamon's Kotaemon, a RAG-based chatbot tool, suffers from a critical security flaw allowing unauthorized access to user conversations. Versions up to v0.12.0 fail to verify conversation ownership before loading or modifying them. Any authenticated user can exploit this by simply knowing another user's conversation ID. This allows them to read, delete, rename, or overwrite any conversation.The vulnerability affects four handlers: select_conv, delete_conv, rename_conv, and persist_chat_suggestions. Without proper authorization checks, these handlers operate on conversations irrespective of ownership. The select_conv handler can expose full chat transcripts and sensitive retrieval history containing excerpts from private documents. Delete_conv allows for permanent deletion of any conversation, with no recovery option.Rename_conv permits renaming conversations, while persist_chat_suggestions can be used to inject malicious prompt suggestions. The disclosure of retrieval history is particularly concerning for enterprise use cases involving proprietary data. Attackers can gain access to sensitive document content without needing direct file-read permissions. Since public conversations display their UUIDs, even private conversations are at risk. No elevated privileges are needed to exploit this vulnerability, only an authenticated account. A solution is not yet available as the vendor could not be reached.

https://kb.cert.org/vuls/id/754548 kb.cert.org

RSS Hunter • Sep 23

VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass

Vendor-signed UEFI Shell applications can be exploited to bypass Secure Boot protections. The vulnerability lies in built-in memory modification commands within certain UEFI Shell implementations. If a system trusts the vendor's certificate or the application's hash, an attacker can use these commands to disable Secure Boot. This allows for the execution of untrusted UEFI code before the operating system loads. Such an attack would bypass standard security measures and EDR solutions. Researchers identified multiple affected UEFI Shell applications from various vendors. To mitigate this, system administrators must apply firmware and software updates from hardware vendors. These updates will replace the vulnerable applications with secure versions. Additionally, updating and verifying the UEFI DBX can revoke trust in the compromised binaries. This prevents them from executing during the boot process.

https://kb.cert.org/vuls/id/738147 kb.cert.org

RSS Hunter • Sep 22

VU#280377: Dokploy is vulnerable to OS command injection

Dokploy versions 0.29.8 and 0.29.11, along with a specific canary branch commit, contain a critical OS command injection vulnerability. This exploit occurs during backup creation and restoration processes due to improper sanitization of user input. The Dokploy application, which runs with root privileges by default, constructs shell commands using this unsanitized input. This allows authenticated users with backup permissions to inject malicious commands. These commands are then executed by the system's shell, granting attackers root-level access to the Dokploy host. Exploitation can lead to full compromise of the target device, including filesystem access and theft of credentials. The vulnerability affects all five database types supported by Dokploy. While Dokploy developers were unreachable, the issue has been fixed in versions 0.29.13 and later. Users are strongly advised to update to the patched versions immediately. As a mitigation, disabling default backup permissions and restricting them to only essential users is recommended for those unable to update. This vulnerability was reported by Muhammadjon Ahmadjonov.

https://kb.cert.org/vuls/id/280377 kb.cert.org

RSS Hunter • Sep 17

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

MLflow, a platform for managing machine learning lifecycles, has a vulnerability in its dspy and statsmodels model flavors. This issue allows unauthorized execution of pickle deserialization, bypassing a safety control. The dspy flavor has a conditional safety control that can be circumvented if the model path does not end with .pkl. The statsmodels flavor completely lacks this safety control, making it vulnerable by default. Loading models via these flavors requires specifying a model and path in an MLmodel file. Exploiting this vulnerability enables arbitrary remote code execution. An attacker could achieve this by loading a malicious pickle payload through a vulnerable flavor. The attack requires write access to the location from which MLflow models are obtained. This vulnerability was confirmed in MLflow version 3.12.0. MLflow has patched the statsmodels flavor in versions 3.15.0 and later. Users are advised to upgrade their MLflow installations. Until the dspy flavor vulnerability is fixed, users should avoid loading models through it if they want to prevent pickle deserialization.

https://kb.cert.org/vuls/id/369093 kb.cert.org

RSS Hunter • Sep 16

VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

A vulnerability exists in Sentry Seer, tracked as CVE-2026-90999, when automated issue remediation is enabled. Sentry is a platform for monitoring software errors and performance. Seer is an automated debugging assistant within Sentry that can generate remediation steps and hand off issues to a coding agent. Attackers can craft malicious events and submit them to Sentry via a public DSN. These events can bypass trust boundaries when Seer is configured to automatically pass issues to a coding agent. Malicious fields within these events are processed by Seer and can be transformed into untrusted instructions for the coding agent. The vulnerable workflow involves Sentry ingesting attacker-generated events that Seer analyzes. Seer uses attacker-controlled fields to generate a root-cause analysis that is embedded in the prompt for the coding agent. The coding agent then interprets this fabricated analysis and may download and execute attacker-controlled packages. This can lead to arbitrary code execution within the coding agent's environment and access to connected source repositories. No patch is currently available, but mitigations include disabling automated remediation or the Seer handoff feature. Restricting coding agent package installation is also a potential mitigation.

https://kb.cert.org/vuls/id/212479 kb.cert.org

RSS Hunter • Sep 16

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

A security vulnerability has been discovered in the exllamav3_ext CUDA extension, identified as CVE-2026-84286. The issue stems from an out-of-bounds memory access caused by unchecked array indexing. Specifically, when the kernel parameter K is set to 0, the code generates a negative array index. This occurs because the checkpoint-derived block index is used to access a fixed-size array without proper validation. The lack of a bounds check during the kernel-table dispatch process is the root cause. Exploiting this vulnerability can lead to an immediate denial of service or application instability. The vendor has released a fix in their main repository. Users should update their installations or apply the patch from the provided pull request. Downstream projects that depend on this library are also indirectly affected. Developers of these dependent repositories are urged to rebuild their packages against the patched version. This vulnerability was discovered by Nathan Keys and reported responsibly.

https://kb.cert.org/vuls/id/369611 kb.cert.org

RSS Hunter • Sep 11

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

An incorrect permissions assignment vulnerability exists in the amwrtdrv.sys kernel driver of AOMEI Backupper 8.4.0. This flaw allows an unprivileged local user to write arbitrarily to the physical disk. When Secure Boot is disabled, this can be exploited to execute malicious UEFI-level code before the operating system loads. Such an attack bypasses OS security controls like HVCI, EDR, and Windows Defender. Additionally, it may allow capture of BitLocker Volume Master Key material. The driver creates a world-accessible device object, enabling unrestricted write requests from any user-mode process. Attackers can modify disk sectors to inject a malicious UEFI payload. This payload executes during the UEFI Boot Device Selection phase, before OS security is active. A successful exploit allows UEFI code injection, bypassing all kernel-mode security. On systems with TPM-only BitLocker, this enables pre-boot VMK credential capture. AOMEI has released patches to address this vulnerability. Users should update to a corrected version or uninstall the software. Disabling the amwrtdrv.sys service is a temporary mitigation. Enabling Secure Boot offers defense in depth but does not fix the root cause.

https://kb.cert.org/vuls/id/687587 kb.cert.org

RSS Hunter • Sep 10

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

The UEFI Shell, when present in firmware, can be exploited to bypass Secure Boot protections. This program offers raw memory access capabilities, which could be abused by attackers. If an attacker can modify UEFI boot configuration, they might create new boot entries to launch the UEFI Shell. This bypasses intended controls that prevent its execution with Secure Boot enabled. The shell's powerful commands like dmem and mm allow direct physical memory access. Attackers could then modify the pre-boot environment, including Secure Boot memory values. This enables the execution of unauthorized software during system startup. The impact is significant, allowing for persistent access and undermining OS security. Applying firmware patches is the primary solution to address this vulnerability. Enterprises should also review Secure Boot configurations and monitor for unauthorized boot entry modifications.

https://kb.cert.org/vuls/id/718077 kb.cert.org

RSS Hunter • Sep 8

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 wireless earbuds, firmware version 1.0.0.28, have a vulnerability allowing unauthorized Bluetooth Classic pairing. These earbuds accept pairing requests from unpaired devices without any user interaction or confirmation. The vulnerability stems from the Airoha chipset used in the earbuds.An attacker within Bluetooth range can pair with the earbuds without prior connection or physical access. They can send a direct pairing request without a PIN or passkey. The earbuds' NoInputNoOutput capability allows this immediate bonding.Once paired, the attacker's device becomes trusted and can automatically reconnect. This enables audio hijacking, interrupting the legitimate user's connection. The only notification for the user is an audible alert after the unauthorized pairing has occurred.Beyond audio, an attacker could potentially access other services on the earbuds. They can also utilize the Hands-Free/Headset profile to capture live microphone audio. The vendor has released a patch in firmware version 1.0.0.30.However, Skullcandy Dime 3 earbuds do not support firmware updates via their application. This means existing units with the vulnerable firmware cannot be updated by customers. There are currently no known methods for users to update their existing devices to the patched firmware.

https://kb.cert.org/vuls/id/859658 kb.cert.org

RSS Hunter • Sep 8

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery vulnerability exists in the ONLYOFFICE ownCloud integration plugin version 9.12. This flaw allows authenticated administrators to manipulate the plugin's backend endpoint. The endpoint fails to properly validate the user-supplied document server URL before initiating outbound connections. An attacker can exploit this by providing arbitrary URLs, including internal network hosts or localhost addresses. This is achieved by sending crafted configuration requests to a specific endpoint. The ownCloud server is then coerced into issuing arbitrary network requests to attacker-controlled destinations. This enables the attacker to use the ownCloud server as a proxy for malicious activities. Furthermore, differences in error messages allow for internal network reconnaissance and port enumeration. The vulnerability grants access to localhost services not reachable externally. While no official patch is available, disabling or removing the plugin is recommended as a mitigation. Implementing network-level egress controls to limit outbound connections is also advised.

https://kb.cert.org/vuls/id/943094 kb.cert.org

RSS Hunter • Sep 8

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor, an open-source access management platform, has an authorization bypass vulnerability. This flaw affects versions 3.115.0 and earlier. It allows non-global organization administrators to execute unauthorized administrative actions on other organizations. The vulnerability arises from a desynchronization between Casdoor's authorization checks and its action execution. Specifically, the authorization layer uses a URL parameter for decisions, while controllers rely on request body fields. This discrepancy means authorization is checked against one object, but an operation is performed on another. In multi-tenant setups, an administrator within one organization can bypass tenant isolation. Exploitation can lead to unauthorized user management, privilege manipulation, and disruption of SSO or SAML identities. This can escalate to a full compromise of tenant isolation or even the entire Casdoor instance. Unfortunately, no vendor patch is currently available. Mitigation strategies include enforcing least privilege, requiring MFA for administrators, and alerting on cross-organization administrative activity.

https://kb.cert.org/vuls/id/889462 kb.cert.org

RSS Hunter • Sep 3

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 allows unauthorized writing of attacker-controlled Python files. The library fetches and caches remote modules before verifying user consent for remote code execution. This means a malicious Python file from a model repository will be written to the user's local cache regardless of trust prompt approval. The vulnerability stems from an unconditional file copy operation that occurs before the trust_remote_code check. This process differs from other remote code loading mechanisms within the library. An attacker could create a model with a malicious custom_generate/generate.py file. Any user loading this model reference triggers the unauthorized file write. The cached malicious files persist even if the trust prompt is declined. In shared cache environments, these files could be executed later during trusted model loads. There is currently no vendor-provided patch. Users should avoid using load_custom_generate() with untrusted repositories and periodically clear their Hugging Face module cache.

https://kb.cert.org/vuls/id/456290 kb.cert.org

RSS Hunter • Sep 1

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

The Kaltura HTML5 Player Library, specifically versions html5lib v2.45, v2.103 and earlier, contains two critical vulnerabilities. Both stem from an insecure deserialization flaw within the mwEmbedLoader.php endpoint. This endpoint allows user-controlled ServiceUrl parameters for backend API requests. The internal KalturaClientBase PHP library fetches data from this URL and deserializes it without validation.CVE-2026-19913 allows arbitrary file reads by exploiting the deserialization flaw and improper error handling. An attacker can provide a file:// path to ServiceUrl, causing the player to fetch and attempt to deserialize local file contents. Failed deserialization reflects raw bytes in error messages, revealing sensitive file data.CVE-2026-19912 enables remote code execution due to insufficient sanitization of the uiconf_id parameter. This parameter controls file write locations, allowing directory traversal attacks. An attacker can craft a malicious serialized object with executable PHP code and redirect its deserialized fields to a web-accessible directory.Exploiting these vulnerabilities requires only network access to the affected endpoint; no authentication is needed. Successful attacks can lead to the theft of sensitive information like credentials or API keys. Remote code execution allows for data manipulation, persistence, and further system compromise. These vulnerabilities also affect tenants on Kaltura's shared CDN infrastructure.Until a vendor patch is released, users should restrict or disable external access to mwEmbedLoader.php. Implementing a strict allow-list for ServiceUrl to permit only legitimate API URLs is also recommended.

https://kb.cert.org/vuls/id/308749 kb.cert.org

RSS Hunter • Aug 25

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

Metal Gear Online 3, a competitive shooter, has a critical security flaw. This vulnerability stems from an input validation issue within the game's Steam lobby metadata processing. Specifically, the game fails to check the size of a buffer used to store Steam IDs of removed players. When a lobby host crafts specific data, they can trick clients into writing beyond this buffer's boundaries. This out-of-bounds write corrupts adjacent memory structures responsible for handling game events.By carefully manipulating this overflow, attackers can hijack the control flow of the game on client machines. This allows them to execute arbitrary code. The exploit is triggered automatically when a player joins an attacker-controlled lobby. The vulnerability is particularly severe because the game binary contains regions with read-write-execute permissions, enabling code injection. An attacker can gain host privileges and then distribute malicious data to all connected players. Konami has addressed this vulnerability in version 1.1.2.9 of Metal Gear Online 3. This patch also updated server and lobby versions to prevent older clients from connecting.

https://kb.cert.org/vuls/id/728712 kb.cert.org

RSS Hunter • Aug 24

VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

The Calix GS7 XGS GS5239XG router, running firmware EXOS/6.6.47, has a critical security flaw. This vulnerability affects its UPnP service, specifically the WANIPConnection aspect. The UPnP service is exposed on the router's public WAN interface without any authentication required. This means a remote attacker can interact with the UPnP service without needing credentials. They can gain full control over the router's essential UPnP functions. This includes the ability to add, delete, and view NAT port mappings. By manipulating these mappings, an attacker can bypass NAT and firewall protections. This action exposes devices on the internal network to the public internet. Residential users are at high risk due to the default UPnP enabled configuration. A vendor patch is not yet available, but users can disable UPnP if possible. If disabling is not an option, contacting the ISP for deactivation might be necessary. Another mitigation involves filtering inbound traffic to TCP port 5000.

https://kb.cert.org/vuls/id/756733 kb.cert.org

RSS Hunter • Aug 21

VU#874418: RDK-B WebUI contains multiple vulnerabilities

The RDK-B WebUI version rdkb-2025q4-kirkstone harbors multiple critical vulnerabilities. These weaknesses include problems with memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker connected to the network could potentially bypass authentication and gain administrative control. These vulnerabilities can also lead to denial-of-service conditions by corrupting memory in underlying RDK-B processes. In some scenarios, this memory corruption might even allow for arbitrary code execution. One specific flaw involves JWT authentication that fails to properly verify cryptographic signatures. Another race condition in the login process can allow an attacker to inherit another user's authentication result. A vulnerability in the login handler allows for denial-of-service by submitting excessively large password values. A data parser flaw can lead to memory corruption and potential code execution due to malformed input. Finally, an authenticated administrator can cause denial-of-service and potential code execution by triggering memory corruption in the rtrouted process. Due to the lack of a coordinated update from RDK Central, users are advised to restrict WebUI access to trusted networks and authorized hosts.

https://kb.cert.org/vuls/id/874418 kb.cert.org

RSS Hunter • Aug 19

VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Two vulnerabilities, CVE-2026-6726 and CVE-2026-6727, have been discovered in the TPM 2.0 reference implementation. CVE-2026-6727 is a timing side-channel flaw in RSA OAEP decryption. CVE-2026-6726 is an information leakage vulnerability related to falsified TPM keys. These issues require privileged local access to the TPM command interface to be exploited. Successful exploitation could allow an attacker to decrypt data encrypted to TPM-managed RSA keys. It may also enable the creation of fraudulent TPM 2.0 attestations using forged keys. The vulnerabilities are detailed in TCG advisories TCGVRT010 and TCGVRT0011. TPM vendors have addressed these flaws by releasing updated firmware and software. Users should apply these updates from their platform or TPM vendor. Cloud providers using software TPMs may have also deployed necessary patches. The overall impact varies based on TPM implementation and usage.

https://kb.cert.org/vuls/id/431093 kb.cert.org

RSS Hunter • Aug 11

VU#614868: Opencart ecommerce platform contains directory traversal vulnerability

OpenCart version 4.2.0.0 has a directory traversal vulnerability in its extension installer. This flaw allows attackers to place files anywhere on the server by exploiting how zip files are extracted. The installer extracts uploaded .zip files without validating the paths derived from the zip entry filenames. Attackers can craft malicious extensions using sequences like ../ to navigate outside the intended directory. This could enable them to write files, including a PHP web shell, into the webroot. If an administrator installs such an extension, it can lead to remote code execution with OpenCart's server privileges. The creation of a web shell further allows for system-level command execution. The vulnerability has been confirmed in version 4.2.0.0, and other 4.x versions might also be vulnerable. A patch is currently unavailable as OpenCart could not be reached for coordination. Users are advised to update to the latest version and avoid installing extensions from untrusted sources while configuring OpenCart with minimal necessary privileges.

https://kb.cert.org/vuls/id/614868 kb.cert.org

RSS Hunter • Aug 10

VU#987105: The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

A heap buffer overflow vulnerability has been identified in the stb TrueType library, specifically in versions 1.26 and earlier. This vulnerability arises from improper handling of malformed TrueType Font (TTF) data within the stbtt_GetGlyphShape() function. The issue occurs during the parsing of glyph contours, where the function iterates based on contour endpoint information. However, it fails to validate that the pointer for these points stays within the allocated glyph data buffer's boundaries. An attacker can exploit this by creating a malicious TTF file with an oversized endpoint count and insufficient glyph data. When an application processes this malformed font using stbtt_GetGlyphShape(), it can lead to out-of-bounds reading of heap memory. The primary impact of this vulnerability is Denial of Service (DoS) due to application crashes from invalid memory access. Additionally, attackers might be able to disclose sensitive information by reading adjacent heap memory. Unfortunately, the stb maintainers have not yet been reachable to coordinate a fix, so users should monitor the project's GitHub for updates. As a precautionary measure, users are advised to consider the warning on the project's README regarding potential delays in security fixes.

https://kb.cert.org/vuls/id/987105 kb.cert.org

RSS Hunter • Aug 7

VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

A cross-site scripting vulnerability has been discovered in Alinto SOGo version 5.12.7. This flaw allows remote code execution by embedding malicious SVG objects within ICS calendar invitations. The vulnerability is actively being exploited in real-world attacks, as evidenced by its appearance on VirusTotal. Alinto SOGo is an open-source webmail and groupware platform used by organizations to manage email, calendars, contacts, and scheduling. The vulnerability stems from SOGo's improper handling of the DESCRIPTION field within ICS files. This field is rendered without adequate sanitization or Content Security Policy enforcement. When a calendar invite includes an SVG payload with JavaScript event handlers, the browser executes the script within the SOGo webmail context. This script execution happens automatically when a user views the calendar, even without direct interaction. The impact of this vulnerability is significant, providing attackers with full read access to a victim's mailbox. This can lead to credential theft via phishing, hijacking of password manager autofill, and exfiltration of all email content and metadata. Attackers can also extract contact lists and calendar data. Users are strongly advised to upgrade to SOGo version 5.12.8 or a later version. This newer version fixes the vulnerability by sanitizing ICS DESCRIPTION content and enforcing stricter handling of embedded SVG and HTML.

https://kb.cert.org/vuls/id/487613 kb.cert.org

RSS Hunter • Aug 6

VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities

VPS.org's one-click deployment templates suffer from multiple vulnerabilities due to static configurations. The Supabase template exposes PostgreSQL to all network interfaces with a hard-coded password, allowing remote attackers to gain superuser access. This unpatched vulnerability enables data theft, modification, denial of service, and persistence. The Zulip template also has a hard-coded application key and a default database password, facilitating session forgery and authentication bypass. Furthermore, it defaults to unencrypted HTTP traffic, exposing sensitive data. These vulnerabilities grant attackers total control over affected systems. VPS.org has not yet released a patch for these issues. Users are strongly advised to change default passwords and secrets before production deployment. Implementing firewalls, network segmentation, and HTTPS are crucial mitigation steps. Simon Gajdosik reported these vulnerabilities.

https://kb.cert.org/vuls/id/243636 kb.cert.org

RSS Hunter • Jul 31

VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Six critical vulnerabilities have been identified in the SGLang project, an open-source framework for serving AI models. These vulnerabilities include unauthenticated remote code execution, server-side request forgery, and local file reading capabilities. Additionally, credential leakage and model weight exfiltration are possible through specific endpoints. Most of these vulnerabilities do not require authentication to exploit. At the time of this report, no patches have been released by the SGLang maintainers, and attempts to coordinate have been unsuccessful. One RCE vulnerability arises from bypassing SafeUnpickler's denylist, allowing arbitrary command execution. Another RCE is present when the dumper subsystem is enabled, permitting sandbox escapes. The multimodal generation endpoint is susceptible to SSRF and local file reads due to unsanitized image URL inputs. Loading model weights from HuggingFace repositories also presents an RCE risk via pickle deserialization. The server_info endpoint can leak API keys and SSL key information. Finally, model weights can be exfiltrated if no API keys are configured. Until patches are available, users are advised to restrict network access, implement network segmentation, and disable unused endpoints.

https://kb.cert.org/vuls/id/281278 kb.cert.org

RSS Hunter • Jul 30

VU#790363: foreUP golf management platform's web API contains multiple vulnerabilities

Two vulnerabilities were discovered in Golf Compete foreUP's REST API. The first vulnerability exposed merchant API credentials directly within customer record responses. These credentials, including username, password, and merchant ID, allowed any user to access the payment processor account. Furthermore, these credentials were identical for all customers at the same facility. The second vulnerability involved a missing object-level authorization check. This flaw, also known as Broken Object Level Authorization and Insecure Direct Object References, permitted users to retrieve any customer's full profile by altering the golfer_id in API requests. This included sensitive information like personal details, payment tokens, and transaction history. Combining both vulnerabilities, an attacker could obtain merchant credentials from any customer's record. With a single low-privilege customer account, one could access any customer's profile, stored payment tokens, and billing history. The shared web API meant all facilities using foreUP were affected. A customer from one facility could access merchant information from another. Thankfully, foreUP confirmed on July 26, 2026, that both vulnerabilities have been fixed. Users are advised to remain vigilant for phishing and identity theft.

https://kb.cert.org/vuls/id/790363 kb.cert.org

RSS Hunter • Jul 30

VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

A vulnerability has been discovered in Develar's app-builder, a command-line build tool used to package and distribute application bundles for macOS, Windows, and Linux. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior in the zipx.Unzip extraction routine. This allows an attacker to overwrite arbitrary files on macOS systems using Apple File System (APFS) by crafting ZIP archives that combine Unicode normalization collisions with malicious symlinks. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges and can result in loss of integrity, denial of service, or potential code execution. Develar's app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories, and several projects have already mitigated their exposure. A complete remediation requires fixing the vulnerability at its source, and a GitHub Pull Request has been developed to provide downstream customers with a reference fix. The Pull Request addresses the symlink-following variant of the vulnerability by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The reporter, Tomas Illuminati, has assisted many downstream vendors and developers in mitigating this issue, and Electron-Userland has responded quickly and implemented a mitigation to protect their downstream users. The vulnerability can be exploited by combining Unicode normalization collisions with symlink-following behavior, allowing an attacker to bypass path-validation checks and redirect writes outside the intended extraction directory. The CERT/CC has prepared a vulnerability note to inform users of the issue and provide guidance on mitigation and remediation. Overall, the vulnerability has significant implications for the security of macOS systems using APFS, and users are advised to take steps to mitigate their exposure.

https://kb.cert.org/vuls/id/293714 kb.cert.org

RSS Hunter • Jul 29

VU#305509: OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

A vulnerability has been discovered in the OPeNDAP Hyrax software solution. This vulnerability allows a remote attacker to cause the application to communicate with unauthorized remote systems. It is classified as a Server Side Request Forgery (SSRF) and credential disclosure issue. The vulnerability stems from unvalidated HTTP redirects that bypass normal security checks. Hyrax fails to re-validate redirect destinations against its AllowedHosts list. Consequently, it can be tricked into connecting to untrusted or internal networks. Additionally, user authentication tokens, such as Echo-Token, may be leaked to attacker-controlled endpoints. Successful exploitation can grant attackers access to internal services not meant for public access. If a user is authenticated, their credentials could be compromised. Administrators are advised to review allowed host configurations and limit gateway endpoint exposure. A patch is expected soon from OPeNDAP, likely in version 1.18.0 or later.

https://kb.cert.org/vuls/id/305509 kb.cert.org

RSS Hunter • Jul 29

VU#141367: AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

The Arris BGW210-700 residential gateway, utilized by AT&T, has a critical security flaw in firmware versions 2.7.7 and earlier. This vulnerability, CVE-2026-16771, allows unauthenticated users on the local network to access sensitive configuration data and alter device settings. The web management interface bypasses server-side authentication, relying only on client-side code, which can be easily circumvented. An attacker can exploit this to retrieve the WiFi password in plaintext and modify network configurations. Multiple diagnostic and configuration pages are affected, including those for WiFi settings and WAN parameters. The impact includes unauthorized network access and manipulation. Fortunately, most devices should have received automatic firmware updates from ISPs, rendering them unaffected. Users can check their firmware version through the device's web interface. It is recommended to confirm automatic update functionality with the ISP. Practicing good network hygiene, like isolating devices and monitoring for unknown clients, can further mitigate risks.

https://kb.cert.org/vuls/id/141367 kb.cert.org

RSS Hunter • Jul 28

VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling

Logto, an identity and access management system, suffers from multiple vulnerabilities in its authentication and authorization pipeline. These flaws weaken security for SaaS and AI applications using OIDC, OAuth 2.1, and SAML. One vulnerability allows account takeover by linking SSO identities to existing accounts without verifying the email. Another allows bypassing nonce verification in OIDC, potentially enabling replay attacks. Logto also mishandles SAML sessions, permitting replayed assertions to authorize multiple sign-ins due to separate lookup and deletion steps. Bypassing SAML Conditions checks allows attackers to circumvent time-based validation on forged or replayed assertions. Crucially, Logto fails to enforce MFA for SSO logins, allowing federated accounts to bypass local security. Inconsistent attribute comparisons in SSO flows can lead to incorrect identity resolution and unintended account linking. These issues collectively create pathways for unauthorized access, compromising account ownership and session integrity. Until patches are available, administrators can mitigate risks by managing email provisioning carefully, avoiding social SAML connectors, and enforcing MFA at upstream IdPs.

https://kb.cert.org/vuls/id/492466 kb.cert.org

RSS Hunter • Jul 23

VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Duplicati v2.3.0.1 has a critical vulnerability related to arbitrary code execution. This vulnerability occurs when Duplicati is installed in a directory other than the default C:\Program Files\Duplicati 2. An attacker with local user privileges who can write files to a non-default installation directory can exploit this. The MSI installer for Duplicati registers a LocalSystem service that executes binaries from the installation directory. When installed in the default location, Windows ACLs protect the directory, preventing unauthorized modifications. However, non-default installations lack these protections, allowing users to write malicious files. If a local attacker places a malicious DLL in such a directory, it can be loaded by the Duplicati service upon restart. This allows the attacker to execute arbitrary code with elevated NT AUTHORITY\SYSTEM privileges. To mitigate this, users should install Duplicati in the default directory or manually secure non-default locations with appropriate ACLs. Applying vendor patches and updating to the latest fixed version of Duplicati is also a crucial solution.

https://kb.cert.org/vuls/id/847406 kb.cert.org

RSS Hunter • Jul 22

VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability

Analog Way's Picturall Quad Compact Mark II server, version 3.5.8, has a critical vulnerability. This local privilege escalation flaw is tracked as CVE-2026-14985. The vulnerability stems from flaws in a maintenance script named create_local_installer.sh. Specifically, improper privilege delegation and insufficient input validation are the root causes. The default permissions allow a low-privileged user to execute create_local_installer.sh as root without a password. An attacker can craft a malicious disk image containing a specially formatted file. This file, picturall-version.txt, uses directory traversal strings to trick the script. The script fails to properly sanitize input from this attacker-supplied file. Consequently, an attacker can write files to any location on the system. This allows arbitrary file writes to sensitive directories like /etc/cron.d. Ultimately, this enables the execution of arbitrary code with full root privileges. Analog Way has released version 3.5.9 to fix this security issue. Users should update immediately to protect their systems.

https://kb.cert.org/vuls/id/360868 kb.cert.org

RSS Hunter • Jul 22

VU#762226: Plane contains multi-tenant authorization bypass vulnerability

The project management tool Plane, in versions 1.3.0 and earlier, has a vulnerability in its asset-management API. This flaw allows unauthorized users to bypass multi-tenant authorization. The API accepts workspace slugs and asset identifiers without verifying user authorization for that workspace. Consequently, an authenticated user can target assets in another workspace. They can access, delete, or duplicate files belonging to different workspaces. To exploit this, an attacker needs to authenticate and know the victim workspace's slug and asset ID. These identifiers can be found in public URLs or API data. The vulnerability could lead to sensitive file exfiltration or data destruction. Unfortunately, a patch is not yet available as Plane developers could not be reached. Users can mitigate risks by implementing network controls for the API endpoints. Enabling detailed activity logging and security alerts is also recommended. Monitoring for cross-workspace requests and unusual operations can help detect exploitation.

https://kb.cert.org/vuls/id/762226 kb.cert.org

RSS Hunter • Jul 21

VU#885548: Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions

A denial-of-service vulnerability affects HTTP/2 servers that mishandle resource consumption during stalled flow-control. Remote, unauthenticated attackers can exploit this by using flow-control parameters to prevent data transmission. This causes servers to buffer response data excessively, leading to memory exhaustion. HTTP/2 uses flow control to prevent senders from overwhelming receivers via window sizes. Clients can stall this flow by not sending WINDOW_UPDATE frames or setting an initial window size of zero. Some server implementations continue generating response bodies even without being able to send them. This buffered data occupies server memory, with each stalled stream consuming resources until the connection ends. Attackers can open many streams, request large resources, and cause significant memory accumulation. This can lead to system instability, crashes, or reduced service availability. Vendors have released updates to address this vulnerability, and implementing resource limits and connection termination helps mitigate risk.

https://kb.cert.org/vuls/id/885548 kb.cert.org

RSS Hunter • Jul 16

VU#326070: SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem

A critical Pickle deserialization vulnerability exists in the SGLang project. This flaw allows attackers to execute arbitrary code remotely on vulnerable servers. Exploitation requires the expert-parallel backup subsystem to be enabled. Additionally, the attacker needs network access to the SGLang service. Currently, there is no patch available for this vulnerability. The project maintainers have not responded to coordination efforts. SGLang is an open-source framework for serving large language models and AI models. The expert-parallel backup subsystem uses a ZeroMQ PULL socket without authentication or deserialization safeguards. This allows attackers to send malicious pickle files leading to remote code execution. Users should restrict access to the service interfaces and avoid exposing them to untrusted networks. Setting SGLANG_USE_PICKLE_IPC to false in environ.py is a recommended mitigation.

https://kb.cert.org/vuls/id/326070 kb.cert.org

RSS Hunter • Jul 16

VU#529388: Privilege escalation vulnerability via unprotected IOCTL interface in Pegatron Tdelo64.sys

A privilege escalation vulnerability exists in the Pegatron tdeio64.sys driver. This issue stems from an unprotected IOCTL dispatch routine that fails to validate user requests. An unprivileged local attacker can exploit this to read and write arbitrary kernel memory. This ultimately allows them to gain NT AUTHORITY\SYSTEM privileges. The driver exposes the \.\TdeIo device interface for privileged IOCTL requests. It lacks adequate access control and validation of user-supplied memory addresses. Crafted DeviceIoControl requests can overwrite process tokens, leading to privilege escalation. Additionally, some IOCTLs allow direct interaction with hardware I/O ports, enabling hardware manipulation. Exploitation results in a complete system compromise, allowing credential extraction and rootkit installation. Currently, no vendor fix is available. Organizations should disable or remove the driver if not needed and consider security features like WDAC or HVCI.

https://kb.cert.org/vuls/id/529388 kb.cert.org

RSS Hunter • Jul 15

VU#725167: node-forge Signature Forgery Vulnerabilities in RSA-PKCS and ED25519 Implementations

Two critical cryptographic signature verification vulnerabilities exist in the widely used node-forge JavaScript library. These flaws allow attackers to forge RSA (PKCS#1 v1.5) and Ed25519 signatures under specific circumstances. The RSA vulnerability, CVE-2026-33894, arises from accepting non-canonical ASN.1 encodings and undersized padding during signature verification. This enables attackers to craft signatures that node-forge validates but standard libraries reject, especially with low public exponents. The Ed25519 vulnerability, CVE-2026-33895, stems from failing to enforce scalar canonicality, allowing signatures with non-canonical scalars to be accepted. This undermines signature uniqueness and enables substitution attacks. Affected versions range from 0.1.2 through 1.3.3 for RSA and 0.7.4 through 1.3.3 for Ed25519. The primary impact is the ability for attackers to bypass authentication, code-signing, or token validations. Applications using default node-forge verification APIs, including popular JOSE libraries, are potentially exposed. Exploitation is straightforward and can occur over the network. Version 1.4.0, released on 2026-04-05, fully addresses these issues by enforcing strict canonical validation for both RSA and Ed25519 signatures. Users are strongly advised to upgrade to this version to patch the vulnerabilities. If immediate upgrading is not feasible, recommended mitigations include auditing call sites and falling back to Node.js native crypto verification.

https://kb.cert.org/vuls/id/725167 kb.cert.org

RSS Hunter • Jul 15

VU#564823: GNU Wget enables SSRF via unvalidated FTP PASV IPs

GNU Wget versions 1.25.0 and earlier have a server-side request forgery vulnerability. This flaw exists in the implementation of FTP passive mode. Wget fails to properly validate IP addresses received in PASV responses from an FTP server. An attacker can control an FTP endpoint and redirect Wget's connection to any IP address. This allows bypassing network access controls to reach internal hosts and services. The vulnerability is similar to previous FTP PASV issues. A malicious FTP server or a redirecting HTTP server could exploit this. The impact includes retrieving service banners or accessing internal endpoints. Applications embedding Wget are especially vulnerable due to automated request handling. GNU has fixed this vulnerability in a recent update. Users should update to a patched version of GNU Wget.

https://kb.cert.org/vuls/id/564823 kb.cert.org

RSS Hunter • Jul 10

VU#152953: PayRange Android app version 7.0.7 contains multiple vulnerabilities

PayRange is a mobile payment application designed for use with unattended machines like vending machines and laundromats. It allows users to make payments using their smartphones via Bluetooth. A critical vulnerability was identified in version 7.0.7 of the PayRange Android application. This vulnerability stems from two distinct security flaws. The first flaw (CVE-2026-13462) concerns the app's handling of SSL certificates within its WebViews. Specifically, the PayRange app incorrectly accepts invalid SSL certificates. The second vulnerability (CVE-2026-13461) permits JavaScript injection. This injection can lead to escaping the WebView sandbox, enabling malicious actions on the user's device. Attackers can exploit these vulnerabilities through on-path interception. They can redirect user traffic to their own controlled device. By presenting a trusted certificate matching specific rules, they can initiate a TLS connection. This allows them to inject content, harvest credentials, and execute unauthorized requests. For machine operators, this could extend to issuing commands to PayRange hardware with full operator permissions. Unfortunately, the vendor could not be reached to coordinate a fix. Users are advised to apply any available software updates from their hardware or software providers.

https://kb.cert.org/vuls/id/152953 kb.cert.org

RSS Hunter • Jul 9