Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Server",
          "vendor": "Royal",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path \nwithout credential override (7.2)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nRoyal Server 5.04.50529.0.\n\nType: Local privilege escalation to LocalSystem on the execution path without credential override (CWE-250)\nCVSS: 7.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: authenticated scripts execute as LocalSystem on the management gateway host\nAuthentication: authenticated (valid admin/session required)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/royal-server-authenticated-local-system-privesc\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:58:36Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/40"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/40"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/royal-server-authenticated-local-system-privesc"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/40"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0313",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/40",
            "automated": true,
            "contentSha256": "9385787c99e7f7d29401b5ac18b09a6c63bc6fa189e50f3d79b756bead6d8910",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/40",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:22:27Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-11T11:58:36Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0313"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Op5 Monitor",
          "vendor": "Itrs Group",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) \n(8.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nOP5 Monitor 9.20.\n\nType: Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (CWE-78)\nCVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: arbitrary command execution as the monitor service user despite the vendor patch for CVE-2025-34115\nAuthentication: authenticated (valid admin/session required)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/op5-monitor-cve-2025-34115-patch-bypass-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:58:30Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/38"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/38"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/op5-monitor-cve-2025-34115-patch-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/38"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-34115",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0311",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/38",
            "automated": true,
            "contentSha256": "65e50e1cd2bcc8482ca17e981840cc2559fb3369f103504d731f6f4706903d9a",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/38",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:21:59Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0311"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-11T11:58:30Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0311"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Quantastor",
          "vendor": "Osnexus",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field \n(8.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nQuantaStor 6.8.3.018.\n\nType: Command injection in the alert-mail command via the smtpPassword field (CWE-78)\nCVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: arbitrary command execution as root on the storage appliance\nAuthentication: authenticated (valid admin/session required)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/quantastor-alertconfigset-smtp-password-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:58:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/37"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/37"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/quantastor-alertconfigset-smtp-password-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/37"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-42081",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0310",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/37",
            "automated": true,
            "contentSha256": "c471dfb6917f5842819d5f43c66f35fdd29aebfdb35a3baa797b50841fab2db5",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/37",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:21:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0310"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-11T11:58:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0310"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Hp Easy Start",
          "vendor": "Hp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1104",
              "description": "CWE-1104",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-319",
              "description": "CWE-319",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-379",
              "description": "CWE-379",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:57:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/30"
        },
        {
          "url": "https://ciphersecuritylabs.com"
        },
        {
          "url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-12554",
              "type": "related"
            },
            {
              "destId": "CVE-2026-12555",
              "type": "related"
            },
            {
              "destId": "CVE-2026-12556",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0184",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
            "automated": true,
            "contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-02T20:13:24Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0184"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-11T11:57:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0184"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Hp Easy Start",
          "vendor": "Hp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1104",
              "description": "CWE-1104",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-319",
              "description": "CWE-319",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-379",
              "description": "CWE-379",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:57:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/30"
        },
        {
          "url": "https://ciphersecuritylabs.com"
        },
        {
          "url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0001",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
            "automated": true,
            "contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-02T20:13:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:41:22Z",
    "dateUpdated": "2026-09-11T11:57:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0001"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Stack-Based Buffer",
          "vendor": "Wireguard",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow exists in the Linux Industrial I/O (IIO)\nuserspace utility lsiio. The vulnerability occurs in the\nfind_type_by_name() function, where the program reads an unbounded string\nfrom a filesystem-backed attribute into a fixed-size stack buffer using\nfscanf(\"%s\", ...).\nIf a crafted or oversized attribute value is present, the unbounded read\ncauses a write beyond the bounds of the destination stack buffer, resulting\nin stack memory corruption.\n\n*Affected Component:*\n\n   - Project: Linux kernel userspace tools\n   - Component: tools/iio/lsiio\n   - Source file: tools/iio/iio_utils.c (compiled via iio_utils-in.c)\n   - Function: find_type_by_name()\n\n\n*Attack Vector:*\n\n   - Local\n   - An attacker who can influence the contents of the filesystem\n   attributes read by lsiio (e.g., via a crafted sysfs-like directory or\n   malicious environment) can trigger the overflow.\n\n\n*Vulnerable Code:*\nThe vulnerable code performs an unbounded string read:\nchar name[IIO_MAX_NAME_LENGTH];\n...\nfscanf(namefp, \"%s\", name);\n\n*Impact:*\nDenial of Service: The application crashes reliably due to stack corruption.\nMemory Corruption: Stack memory is overwritten, which may be exploitable\ndepending on build configuration, compiler protections, and runtime\nenvironment. Although the issue is triggered locally, lsiio is shipped with\nmultiple Linux distributions as part of kernel userspace tooling, and the\nvulnerable code executes prior to any bounds validation.\n\n*Proof of Concept:*\n# python3 -c \u0027print(\"A\" * 4096)\u0027 \u003e /tmp/iio/devices/iio:device0/name\n# wc -c /tmp/iio/devices/iio:device0/name\n4097 /tmp/iio/devices/iio:device0/name\n\n*Output:*\n\n# ./lsiio\n=================================================================\n==169698==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff91900060 at pc 0xaaaabaf3fb10 bp 0xfffff130c8d0 sp 0xfffff130c0a8\nWRITE of size 4097 at 0xfbff91900060 thread T0\n    #0 0xaaaabaf3fb0c  (/root/wireguard-linux/tools/iio/lsiio+0x5fb0c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #1 0xaaaabaf40a04  (/root/wireguard-linux/tools/iio/lsiio+0x60a04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #2 0xaaaabb00d3d4  (/root/wireguard-linux/tools/iio/lsiio+0x12d3d4)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #3 0xaaaabb002b04  (/root/wireguard-linux/tools/iio/lsiio+0x122b04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #4 0xaaaabb0021fc  (/root/wireguard-linux/tools/iio/lsiio+0x1221fc)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #5 0xaaaabb001ec0  (/root/wireguard-linux/tools/iio/lsiio+0x121ec0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #6 0xffff93982598  (/lib/aarch64-linux-gnu/libc.so.6+0x22598) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n    #7 0xffff93982678  (/lib/aarch64-linux-gnu/libc.so.6+0x22678) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n    #8 0xaaaabaf1b26c  (/root/wireguard-linux/tools/iio/lsiio+0x3b26c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nAddress 0xfbff91900060 is located in stack of thread T0 at offset 96 in\nframe\n    #0 0xaaaabb0027b0  (/root/wireguard-linux/tools/iio/lsiio+0x1227b0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:57:07Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/17"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17",
            "automated": true,
            "contentSha256": "e8715268b91f48cad7e419ae73ffd61eafc139f3587a7f13ebbd0c40ca39b999",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:49:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-11T11:57:07Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Enterprise",
          "vendor": "Puppet",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Enterprise 2025.10.0.\n\nType: Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\nImpact: Root command execution on the PE master, the control plane of the managed fleet: catalogs, certificates, \nsecrets, and orchestration under attacker control.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/puppet-enterprise-keytool-injection-root-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/9"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/puppet-enterprise-keytool-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Puppet Enterprise 2025.10.0 Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (8.8)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-5459",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0173",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/9",
            "automated": true,
            "contentSha256": "3594040db38248dc461f899ed19c8656a2bad99511f7a2a4e74dc625a369dbee",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:11:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0173"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-11T11:56:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0173"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Enterprise",
          "vendor": "Puppet",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Enterprise 2025.10.0.\n\nType: Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\nImpact: Root command execution on the PE master, the control plane of the managed fleet: catalogs, certificates, \nsecrets, and orchestration under attacker control.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/puppet-enterprise-keytool-injection-root-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/9"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/puppet-enterprise-keytool-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Puppet Enterprise 2025.10.0 Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0168",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/9",
            "automated": true,
            "contentSha256": "3594040db38248dc461f899ed19c8656a2bad99511f7a2a4e74dc625a369dbee",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:11:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T11:56:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0168"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Terminal Server",
          "vendor": "Nomachine",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in NoMachine Terminal Server 10.0.57.\n\nVulnerability 1 \u2014 Pre-authentication heap memory corruption (out-of-bounds write to double-free) (CVSS 9.8, \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787)\n\nNoMachine Terminal Server is a closed-source remote-desktop gateway used by enterprises to deliver virtual desktops and \nremote sessions over HTTPS. The nxwebrunner CGI RequestCollector::parsePOST contains an unbounded quote-scan loop and \nan unbounded name-copy loop; a single unauthenticated multipart/form-data POST with a filename attribute reads past the \nbody terminator and overflows heap chunk metadata. The cleanup path frees the corrupted chunk, producing a double-free \nabort and an RCE-capable heap-overflow primitive (verified: 9/10 trigger requests crashed).\n\nAuthentication: unauthenticated / pre-auth\n\nVulnerability 2 \u2014 Pre-authentication stack buffer overflow with return-address control (CVSS 9.8, \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787)\n\nIn the same nxwebrunner CGI, RequestCollector::parsePOST copies attacker-controlled multipart name and value fields and \nthen executes sprintf(stack_buf, \"%s=%s\u0026\", name, value) into a 1032-byte stack buffer. When name + value + 2 exceeds \n1032, the write overwrites saved registers and the return address. The binary is non-PIE with stack canaries disabled, \nso the attacker controls the return address (verified in core dumps); stable RCE currently requires a leak primitive, \nbut the pre-auth crash is deterministic.\n\nAuthentication: unauthenticated / pre-auth\n\nFull technical analyses and reproducible proofs-of-concept:\n  https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-heap-corruption\n  https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-stack-overflow\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:39Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/8"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-heap-corruption"
        },
        {
          "url": "https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-stack-overflow"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] NoMachine Terminal Server 10.0.57 two vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0167",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/8",
            "automated": true,
            "contentSha256": "947019dcef07e6da69699de40cb1846fc86a6de7f2b7fde9d3f888ddd42496c8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:11:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T11:56:39Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0167"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "EDS3000PR",
          "vendor": "Lantronix",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.\n\nVulnerability 1 \u2014 Authenticated command injection to root RCE in FsUnmount (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nLantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a \nuser-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and \nnewlines, then executes /sbin/ltrx_usb_umount \u0027/ltrx_user\u003cpath\u003e\u0027 via /bin/sh -c. A newline breaks out of the \nsingle-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot \nusing the real rootfs /bin/sh.\n\nAuthentication: authenticated (requires valid session)\n\nVulnerability 2 \u2014 Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nOn the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin \npass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics \nhandler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character \nsanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host \nfield; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics \nvectors.\n\nAuthentication: authenticated (requires valid session)\n\nFull technical analyses and reproducible proofs-of-concept:\n  https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection\n  https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0165",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6",
            "automated": true,
            "contentSha256": "06ba7fc5d15136ee62ee34cb74db1c10b234c3b66a7cb5d42fb6f500d9dc4431",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:10:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T11:56:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0165"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}