Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Tornado",
          "vendor": "Tornado",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nTornado 2.11.3.\n\nType: Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (CWE-22)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nImpact: Unauthenticated attacker writes arbitrary files and achieves root command execution via cron\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/docmosis-tornado-unauth-storeto-file-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:10:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/71"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/71"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/docmosis-tornado-unauth-storeto-file-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/71"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Tornado 2.11.3 Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0147",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/71",
            "automated": true,
            "contentSha256": "0b47d1c723325d874bbd63bb5820ea29892aca38eafafa205d04423832e52cb4",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/71",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T04:58:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:10:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0147"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Call Center Suite",
          "vendor": "Vicidial",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Call Center Suite 10.10.1 Pre-authentication RCE (auth bypass + webroot write) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Call Center Suite 10.10.1.\n\nType: Pre-authentication RCE (auth bypass + webroot write) (CWE-306)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nImpact: Unauthenticated root RCE on the call center server, including call recordings, IVR configuration, and customer \ndata.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/voicent-savefile-unauth-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:08:30Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/50"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/50"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/voicent-savefile-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/50"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Call Center Suite 10.10.1 Pre-authentication RCE (auth bypass + webroot write) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0071",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/50",
            "automated": true,
            "contentSha256": "65a467baf02e38afb826a1ca661eb7026fbba274b03699b10871646b1736ead6",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/50",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:26:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T08:08:30Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0071"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-002\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-002\n------------------------------------------------------------------------\nDate: 2026-06-03\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.6\nVersions not affected: \u003e= 6.0.7\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34912\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650504\nhttps://github.com/revive-adserver/revive-adserver/commit/e1c9b8478\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34913\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\nrelationships.\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650582\nhttps://github.com/revive-adserver/revive-adserver/commit/f1b5e8504\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n3. Blind SQL Injection\n========================================================================\nVulnerability Type: CWE-89: SQL Injection\nCVE-ID: CVE-2026-34914\nRisk level: High\nCVSS Base Score: 8.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653196\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/89.html\n\n\n========================================================================\n4. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-34915\nRisk level: Medium\nCVSS Base Score: 6.1\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653316\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-34916\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3656781\nhttps://github.com/revive-adserver/revive-adserver/commit/de3525e12\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n6. Improper Authentication\n========================================================================\nVulnerability Type: CWE-287: Improper Authentication\nCVE-ID: CVE-2026-34917\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3672641\nhttps://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba\nhttps://cwe.mitre.org/data/definitions/287.html\n\n\n========================================================================\n7. Stored XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-44956\nRisk level: Medium\nCVSS Base Score: 5.4\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\nProper escaping has been added to the userlog details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3669623\nhttps://github.com/revive-adserver/revive-adserver/commit/6254115b7\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n8. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44957\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3677576\nhttps://github.com/revive-adserver/revive-adserver/commit/5860e2f86\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n9. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44958\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3678828\nhttps://github.com/revive-adserver/revive-adserver/commit/2af365841\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n10. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-44959\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3744200\nhttps://github.com/revive-adserver/revive-adserver/commit/6c6161420\nhttps://cwe.mitre.org/data/definitions/94.html\n\n========================================================================\n11. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-44960\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\nthe username would be executed due to missing output sanitisation.\n\nResolution\n----------\nProper escaping has been added to the audit log details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n12. Incomplete List of Disallowed Inputs\n========================================================================\nVulnerability Type:    CWE-184: Incomplete List of Disallowed Inputs\nCVE-ID:                CVE-2026-44961\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\nHackerOne community member barcrange (3l4) has reported that the XML\u2011RPC API\n\nCVE\u20112025\u201155129. As a result, API users could create usernames that enabled\nimpersonation or stored XSS attacks.\n\nResolution\n----------\nProper validation has been added where it was missing.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/229cf361b\nhttps://cwe.mitre.org/data/definitions/184.html\n\n\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/0"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/184.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/287.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/89.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/229cf361b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/2af365841"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/5860e2f86"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6254115b7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6c6161420"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/b541d1d05"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/de3525e12"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e1c9b8478"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f1b5e8504"
        },
        {
          "url": "https://hackerone.com/reports/3650504"
        },
        {
          "url": "https://hackerone.com/reports/3650582"
        },
        {
          "url": "https://hackerone.com/reports/3653196"
        },
        {
          "url": "https://hackerone.com/reports/3653316"
        },
        {
          "url": "https://hackerone.com/reports/3656781"
        },
        {
          "url": "https://hackerone.com/reports/3669623"
        },
        {
          "url": "https://hackerone.com/reports/3672641"
        },
        {
          "url": "https://hackerone.com/reports/3677576"
        },
        {
          "url": "https://hackerone.com/reports/3678828"
        },
        {
          "url": "https://hackerone.com/reports/3680090"
        },
        {
          "url": "https://hackerone.com/reports/3744200"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-002"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34916",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44961",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0376",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0",
            "automated": true,
            "contentSha256": "38353b4aad227a84e5f5423124ed92bb9eccc2c021361c590c300ad74d739e41",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-03T13:43:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0376"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0376"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "bmcweb OpenBMC web",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "binreaper via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi all,\n\nPosting a brief summary of a four-finding disclosure on bmcweb (the OpenBMC HTTP/Redfish web server), which ships in \nBMC firmware on most modern enterprise servers \u2014 Intel, IBM, HPE, NVIDIA, and various ODMs.\n\nFull timeline and analysis on the blog:\n\n  https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/\n\n## Why bmcweb matters\n\nA Baseboard Management Controller boots before the host CPU, has full control over the server (power, firmware, \nconsole, in some configurations DMA), and is reachable from the management network. bmcweb is OpenBMC\u0027s HTTP front door \n\u2014 Redfish API, web UI, KVM/console WebSocket. C++23 on Boost.Beast, single-threaded async, supports HTTP/1.1 and HTTP/2.\n\nThe single-threaded design means any blocking operation, large allocation, or event-loop stall takes the entire \nmanagement interface offline.\n\n## The four findings\n\nAll reported 2026-02-23 to openbmc-security () lists ozlabs org.\n\n| ID | Title | CVSS | Status |\n|----|-------|------|--------|\n| CONN-F2 | `Expect: 100-continue` bypasses body_limit (pre-auth OOM) | 7.5 | FIXED \u2014 commit `0b2049b0` (2026-04-21), \nGHSA-p3gc-68x5-g9w3 |\n| H2-F2 | HTTP/2 `Content-Length` trusted for `std::string::reserve()` (instant OOM) | 7.5 | FIXED \u2014 commit `62526bb0` \n(2026-04-21), silent (no advisory) |\n| H2-F1 | HTTP/2 no body_limit per stream (pre-auth OOM via streamed DATA frames) | 7.5 | UNFIXED \u2014 Gerrit 90580 today |\n| AUTH-F6 | mTLS UPN suffix matching authenticates parent-domain / TLD-only certs | 6.8 | UNFIXED \u2014 Gerrit 90581 today |\n\n## Three things worth flagging to this audience\n\n1. **GHSA-p3gc-68x5-g9w3 has no CVE attached** (`cve_id: null`). It is not in NVD, OSV, the GitHub global Advisory \nDatabase, or any distro security tracker that I checked. From a downstream-propagation perspective, the GHSA exists \nonly on the bmcweb security tab. The upstream maintainer\u0027s 2026-05-14 reply: \"As far as I\u0027m aware, there will be no CVE \nassigned for this.\"\n\n2. **One of two coordinated 2026-04-21 patches got an advisory; the other didn\u0027t.** CONN-F2 (the HTTP/1.1 bug) got \nGHSA-p3gc. H2-F2 (the HTTP/2 sibling, same severity band, fix landed in the same minute) got no advisory at all. Anyone \napplying bmcweb 3.0.0 because of the published advisory gets the H2-F2 fix as a side effect but doesn\u0027t know it.\n\n3. **Intel firmware containing the unpatched binary is still on Intel\u0027s Download Center.** M50FCP BMC 2.94-0 (Download \nCenter ID 775817), dated January 2026, predates the upstream fix. I submitted CONN-F2 to Intel\u0027s bug bounty program \n(Intigriti); triage accepted the scope, then closed out-of-scope under an \"open-source projects we contribute to\" \nclause five hours later, despite the submission being explicitly about the vendor-distributed binary.\n\n## H2-F1 (unfixed, posted today)\n\nbmcweb\u0027s HTTP/1.1 path inherits its body limit from Boost.Beast\u0027s parser; the HTTP/2 path does not. \n`HttpBody::reader::put()` in `http/http_body.hpp` appends incoming DATA-frame bytes to `value.str()` (a `std::string`) \nwith no size check. Authentication runs in `onRequestRecv()` on END_STREAM \u2014 i.e., after the full body has been \nreceived and buffered. nghttp2 auto-replenishes flow-control windows by default; bmcweb does not set \n`nghttp2_option_set_no_auto_window_update`.\n\nResult: any client that can complete the TLS handshake (ALPN h2 is the default protocol path) can stream unlimited DATA \nframes before authentication is ever attempted. The single-threaded event loop dies from OOM.\n\nSuggested fix in Gerrit 90580 (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90580): per-stream byte counter on \n`HttpBody::reader`, bound at the existing `BMCWEB_HTTP_BODY_LIMIT` (30 MiB by default).\n\n## AUTH-F6 (unfixed, posted today)\n\n`isUPNMatch()` in `http/mutual_tls.cpp` performs domain suffix matching when validating mTLS client certificates in \nUserPrincipalName mode. The algorithm walks dot-separated labels right-to-left and returns true once the UPN domain \nruns out of labels, regardless of how many hostname labels remain. The project\u0027s own existing unit test asserted the \nconsequence as expected behaviour:\n\n  EXPECT_TRUE(isUPNMatch(\"user@com\", \"hostname.region.domain.com\"));\n\nA certificate with a UPN that is just a TLD authenticates any BMC in that TLD; a parent-domain certificate \nauthenticates any nested BMC. CVSS 6.8 because UPN mode is opt-in (default is CommonName) and requires a CA-signed \nclient cert with the broad UPN.\n\nSuggested fix in Gerrit 90581 (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90581): replace the walk with exact-match \nplus one-label-prefix tolerance (preserves `user () domain com` matching `bmc-01.domain.com`; rejects deeper nesting).\n\n## Disclosure status\n\nMaintainer-side track is closed per Ed Tanous\u0027s 2026-05-14 reply (\"This bug is no longer embargoed, and the fix is on \nmaster. There\u0027s no longer a reason to send direct messages to the security responders. If you believe further action is \nneeded, please use the normal project communication channels.\"). Earlier today the H2-F1 and AUTH-F6 disclosures went \nto openbmc () lists ozlabs org with their respective Gerrit changes. This Full Disclosure post is the broader-audience \nsignal.\n\nReproducers exist for CONN-F2 and H2-F1 (Python; pocs/bmcweb/ in my files). I am not attaching them; happy to share \nwith downstream vendor PSIRTs or fork maintainers on request.\n\nBest regards,\nbinreaper\nbobdabot () proton me\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/24"
        },
        {
          "url": "https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/"
        },
        {
          "url": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90580"
        },
        {
          "url": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90581"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "bmcweb (OpenBMC web server): four vulnerabilities \u2014 two unfixed, GHSA without a CVE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0375",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/24",
            "automated": true,
            "contentSha256": "6852b448e7d72ea2ff80ff82586b29e359572243987e20550b5e76b62591f199",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-27T10:32:42Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0375"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2021-001\nCVE ID:         CVE-2021-21735\nTitle:          ZTE ZXHN H168N V3.5 - Unauthenticated Wizard Credential\nDisclosure to Full Admin Compromise\nAffected:       ZTE ZXHN H168N V3.5\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2021-21735\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe ZTE ZXHN H168N V3.5 firmware exposes quick-setup wizard endpoints that\nreturn PPPoE credentials (ADUsername, VDUsername) and the WLAN KeyPassphrase\nvia the GetPassword action without requiring authentication. The firmware\nrouting allowlists these endpoints through a QuickSetupEnable branch.\n\nIn ISP-deployed configurations where the Wi-Fi password is reused as the\ndefault admin password, this credential disclosure is a full admin\ncompromise\nchain requiring a single unauthenticated HTTP request.\n\nA bulk PoC script (zte_zxhn_h168n_bulk_poc.py) is included in the repository\nfor verifying scale of exposure.\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/21"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21735"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-21735",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0373",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21",
            "automated": true,
            "contentSha256": "d2f8f5a013e08bcb4b6b6a60a012c74c16d028380aa5efa7266932a9a7661620",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:33:37Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0373"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0373"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-003\nCVE ID:         CVE-2026-34474\nTitle:          ZTE ZXHN H298A / H108N - Unauthenticated Admin Password \u0026\nWLAN Credential Exposure\nAffected:       ZTE ZXHN H298A 1.1, ZTE ZXHN H108N 2.6 (EOL; no patch\nplanned)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34474\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nA single unauthenticated HTTP GET to /getpage.lua?pid=1000\u0026ETHCheat=1 on ZTE\nH298A or H108N routers returns the live administrator password\n(OBJ_USERINFO_IDPassword1), WLAN PSK (WLANPSK_KeyPassphrase1), and SSID in\nplaintext HTML. A second endpoint exposes the device serial number.\n\nNote: ZTE declined vendor-side assignment citing product EOL. MITRE assigned\nCVE-2026-34474 directly and published the record 2026-05-06. These devices\nremain deployed by some ISPs.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/20"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34474"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34474 - ZTE H298A/H108N Unauthenticated Admin Credential Exposure",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34474",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0372",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20",
            "automated": true,
            "contentSha256": "d7deed16f4c2f767f2f9e74eba7d57baf4fe782bf28eb334f544ee50fa181f82",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0372"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0372"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-002\nCVE ID:         CVE-2026-34472\nTitle:          ZTE ZXHN H188A V6 - Authentication Bypass via Pre-Login\nWizard Credential Leakage\nAffected:       ZTE ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34472\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nUnauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware can\nreach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and PPPoE\nusernames. The leaked Wi-Fi password is also the default administrator\npassword after uppercasing, resulting in full authentication bypass.\n\n\nROOT CAUSE\n----------\nrouter_logic_impl.lua accepts attacker-controlled _type and _tag parameters\nfor empty-path requests. urlpath_2type_modifier.lua only activates the\nQuickSetupEnable gate when _type is absent. Supplying _type explicitly\ncauses\nthe wizard handlers (getPassword, wlan_get, ppp_get) to execute for\nunauthenticated requests, returning WLAN PSKs, SSIDs, and PPPoE credentials.\n\n\nTIMELINE\n--------\n2024-04-26: Local validation and PoC artifacts created.\n2024-05:    Report sent to ZTE PSIRT.\n2024-05-10: ZTE PSIRT stopped responding.\n2026-01-17: Escalated to MITRE.\n2026-02-02: ZTE PSIRT explicitly declined CVE assignment.\n2026-03-27: MITRE assigned CVE-2026-34472.\n2026-05-20: Full public disclosure.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/19"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34472"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34472 - ZTE ZXHN H188A V6 Authentication Bypass via Pre-Login Wizard",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34472",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0371",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19",
            "automated": true,
            "contentSha256": "d8794116ee18499a7c4b69c4cb15a17272f0a479facc72de09a45ac51eca99a5",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0371"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0371"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-001\nCVE ID:         CVE-2026-34473\nTitle:          Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected:       17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score:     7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router\u0027s web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n  import requests\n  url = \"http://TARGET_IP/cgi-bin/luci\";\n  payload = \"a=\" + \"A\" * (256 * 1024)  # 256 KB\n  headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n  try:\n      r = requests.post(url, data=payload, headers=headers, timeout=15)\n      print(f\"HTTP {r.status_code}\")\n  except requests.exceptions.Timeout:\n      print(\"Timeout - DoS successful\")\n  except requests.exceptions.ConnectionError:\n      print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05:   Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05:   Report sent to ZTE PSIRT.\n2025-01:   Escalated to MITRE after ZTE failed to respond.\n2026-03:   MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/18"
        },
        {
          "url": "http://TARGET_IP/cgi-bin/luci\""
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34473",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0370",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
            "automated": true,
            "contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:31:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0370"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0370"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Sprecher Automation SPRECON-E-C/-E-P/-E-T3\n\u00a0vulnerable version: See vulnerable versions below\n      fixed version: See solution section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2022-4333, CVE-2022-4332, CVE-2025-41741,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-41742, CVE-2025-41743, CVE-2025-41744\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.sprecher-automation.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2022-08-26\n                 by: Steffen Robertz\n                     Christian Hager (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n=======================================================================\n\nVendor description:\n-------------------\n\"Sprecher Automation provides products and solutions for power supply\nand process automation. We secure critical infrastructures and optimise\ncomplex energy and industry processes. [...]\nQuality, availability and security \u2013 those are not only our customers\u0027s\nrequirements, but also goals we are striving for. Due to that, for example,\nthe hard- and software development are located in Austria and Germany.\nWe produce exclusively in Austria \u2013 starting with the production of\nsingle elements, to system checks and practical inhouse testing.\"\n\nSource:https://www.sprecher-automation.com/en/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides updated versions as well as workaround information in\ntheir security advisories. Users should verify whether the patches are\ninstalled already, otherwise patch immediately.\n\nSEC Consult highly recommends to perform a thorough security review of\nthe product conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nSprecher signs its firmware update files to prevent an attacker from\nloading manipulated update files. However, each PLC contains the\nglobally valid private signing key, as it is also used to sign backups.\nAn attacker, who obtains the key is able to ship validly signed,\nmodified firmware updates.\n\nThe security vulnerability has been resolved in firmware version 9 and\nabove. Further details can be found in the advisory of the vendor. In\nprevious versions the affected feature can be deactivated by the customer.\nThe stated key can only be used in conjunction with the backup feature.\nAffected products: SPRECON-E-C/-E-P/-E CPU Modul\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe PLC is able to detect secure boot violations correctly. However,\nthe events are not handled properly. They only output a warning to the\nboot log, but do not prevent the device\u0027s operation. Thus, anybody with\nphysical access to the device can modify the firmware and potentially\ninclude backdoors.\n\nThe security vulnerability has been resolved in firmware version 8.71a and\nabove, as well as 8.64m. Further details can be found in the advisory\nof the vendor. In current and previous versions the affected feature can be\ndeactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe external flash memory can be dumped using tools such as the Xgecu\nT56. This allows an attacker with physical access to read all files and\nthus gain knowledge about sensitive files such as passwords and private\nkeys.\n\nThe security vulnerability has been resolved in firmware version 9 and above.\nFurther details can be found in the advisory of the vendor. In current and\nprevious versions the affected feature can be deactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n4) Usage of static passwords (CVE-2025-41742)\nVarious static passwords / key material can be discovered in the firmware.\nThey serve  different use cases, such as hard-coded user accounts, as well as\nencryption for settings and configuration files. This allows an attacker\nto decrypt configuration files, modify them and properly encrypt them\nagain.\n\nAccording to the vendor, the documented static identity string does not serve\na security purpose in the system and is used as an identifier for maintenance.\nUsing the default identifier can lead to the targeted system being misidentified\nduring maintenance.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nTwo hard-coded vendor accounts were revealed in the devices. These\naccounts are shipped with every update file and can be used by the\nvendor e.g. for support access.\n\nThese documented accounts can be activated or deactivated in the configuration.\nThese accounts are additionally secured with 2FA in firmware version 8.71g.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nFirmware update files include hard-coded accounts from vulnerability 5 and\ncan be decrypted using an XOR algorithm and a static password. This\nallows an attacker to further analyze PLC components as well as gaining\nknowledge of private keys and hard-coded accounts without requiring\nphysical access to any device.\n\nThe signature and encryption mechanism have been modified and the security\nvulnerability has been resolved in version 8.71 and above. Further details\ncan be found in the advisory of the vendor.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe PLC\u0027s webserver and the connection to the Sprecher Engineering Center\nsoftware use the same static default key on all devices. An attacker who gains\naccess to the private key via vulnerability 3 or 6 can thus decrypt all\ntraffic in a man-in-the-middle position. Thus, an attacker would be\nable to change configurations and read connection passwords.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it clear that it is both possible and\nrecommended to change the default certificate.\nDocumentation: 94.2.913.50en SPRECON Basic Hardening\n\n\nProof of concept:\n-----------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nBackups are restored by the same command flow as regular update files.\nThus, backups need to be validly signed as well. For this, Sprecher\u0027s\nprivate key is required. The following openssl command signs the\ncreated backup:\n\n```\nopenssl dgst -sha256 -sign ${SSM_CERT}/.backup.key -passinfile:${SSM_CERT}/.pass -out\n${SSM_SECURE_DIR}/image.sha256 ${SSM_SECURE_DIR}/image.zip 2\u003e/dev/null\n```\n\nThe private key and password are both stored in the same filesystem and\ncan be obtained via the decrypted firmware update file (vulnerability 6)\nor the unencrypted flash memory (vulnerability 3).\n\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe main SoC of the SPRECON E-C-94 is an i.MX6. The board does not fully\nenable High-Assurance Boot (HAB). Thus, the firmware and bootloader can\nbe modified. The modification is detected, however, since secure boot is\nnot fully enabled, the violation will not be handled. The following boot\nlog  can be seen on the device\u0027s service connector (X6). The first\nbootline was manipulated to include the string \"SECTEST\".\n\n```\nREL_UBOOT_SECTEST_2015_07_RC7 SPL (Mar 11 2022 - 10:55:26)\nBooting from SPI\nImage Entry Point: 0x17800000\nImage Load Address: 0x177FFFC0\nImage Size: 0x48000\nAuthenticate image from DDR location 0x177fffc0...\nAuthenticated Image Size = 0x46000\nLoad Addr = 0x17800000\nHAB not enabled\nU-Boot Authentication Successful\n[...]\nAuthenticate image from DDR location 0x12000000...\nAuthenticated Image Size = 0x7bc000\nHAB not enabled\nHAB Configuration: 0xf0, HAB State: 0x66\n--------- HAB Event 1 -----------------\n[...]\nzImage Authentication Successful\n```\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe main memory is a BGA153 eMMC flash memory. Thus, it can be read by\nmultiple tools such as the Xgecu T56. By dumping its contents, an\nattacker can extract password hashes from the `/etc/passwd` or\n`/etc/shadow` file and gain access to the private key from\nvulnerability 1.\n\n\n4) Usage of static passwords (CVE-2025-41742)\n\u00a0 \u00a0 4.1) Static Passwords in Sprecher Engineering Studio\n                 Two different passwords can be used to call an internal function.\n         This can be seen in following code snippet:\n                \n                 ```\n                 iVar3 = _strcmp(local_28,\"**redacted**\");\n                 if (((iVar3 == 0) || (iVar3 = _strcmp(local_28,\"**redacted**\"), iVar3 == 0)) ||(iVar3 = \n_strcmp(local_28,\"**redacted**\"), iVar3 == 0)) {\n                        FUN_10001780(local_28,0x20,\"XXX\");\n                 }\n                 ```\n                \n                 Unfortunately, we were not able to fully determine the use case of\n         these credentials.\n        \n        4.2) Static Passwords in Sprecher Engineering Studio Configuration files\n                 When exporting configurations from the Engineering Studio, a .sprXecz\n                 file will be created. It is encrypted using a static password.\n\n        4.3) Webserver Settings Export\n                 The webserver exports its settings as .jzp file. However, this\n                 is just a renamed .zip file which uses a static password.\n\n        4.4) OpenVPN and IPSEC Settings Export/Import\n                 OpenVPN profiles and IPSEC settings are exported/imported as\n                 zip files. They are encrypted with a static password.\n\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nThe `/etc/passwd` file and `/etc/shadow` file reveal hard-coded password\nhashes for the \"sprecon\" and \"spradm\" accounts. These accounts are shipped\nwith the update files (tested with official downloadable version 8.71) and\nthere seems to be no option for deleting or changing their passwords.\n\nThe usability of the accounts is configurable via the configuration.\nDetails to deactivate the accounts are included in the hardening guidelines.\n\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nSPRECON firmware update files are encrypted. However, they use XOR magic\nand static passwords as encryption method. Due to limited time, we did\nnot reverse engineer the XOR algorithm and instead ran the decoding\nbinaries using QEMU. First, the fwimaker binary was run to create a\nregular zip file from the XORed .fwi file by running the following\ncommand:\n\n```\nqemu-arm -L /usr/arm-linux-gnueabihf ./fwimaker x sce_P9pu244_sc_864l_crypt.fwi extracted.zip\n```\n\nAfterwards the ZIP file can be decompressed and decrypted.\nAn attacker is now able to read the static password hashes and\nfurther analyze components of the PLC.\n\nAccording to the vendor, manipulated firmware update files cannot be\nflashed anymore, due to the usage of firmware signing.\n\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe file `/etc/rbac/default.pem` contains a private key which is used\nfor the HTTPS encryption of the webserver. Further, the same key is used\nto encrypt the communication with the Sprecher Engineering Studio.\nAn attacker can use vulnerability 3 or 6 to obtain the private key\nand can then decrypt communication in a man-in-the-middle position.\nThe certificate has following fingerprint:\n\n```\nE9:AF:F4:F1:90:83:3C:5B:0B:E2:DF:E1:DF:31:69:B5:C1:EC:90:52\n```\n\nOne device using the same certificate was discovered on the internet.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.sprecher-automation.com/"
        },
        {
          "url": "https://www.sprecher-automation.com/anfrage-sprecon"
        },
        {
          "url": "https://www.sprecher-automation.com/en/company"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511044_de.pdf"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2022-4332",
              "type": "related"
            },
            {
              "destId": "CVE-2022-4333",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41741",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41742",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41743",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41744",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0368",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19",
            "automated": true,
            "contentSha256": "5090538895e185dcc7127720faf216b67257c06163b3544d734b5679dbc589e5",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T05:51:31Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0368"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0368"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Slate Digital Connect (macOS)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260610-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Slate Digital Connect (macOS)\n\u00a0vulnerable version: 1.37.0\n      fixed version: -\n         CVE number: CVE-2026-24066, CVE-2026-24067\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://app.completeaccess.audio/installers,https://slatedigital.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-09\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Slate Digital was founded in 2008 with a mission to deliver exceptional audio\nproduction tools to musicians, engineers, producers, and content creators. With\nour extensive expertise and knowledge, we are constantly evolving to stay in\nstep with the changing needs of modern creatives. Our goal is to inspire and\nempower individuals of all skill levels to do their best work and share it\nwith the world.\"\n\n\"Slate Digital Connect lets you install, activate, and update all Slate Digital\nplugins. Whether you need a fresh install, to move to a new machine, or to grab\nthe latest updates, Slate Digital Connect handles downloads, licenses, and\nupgrades automatically.\"\n\nSource:https://slatedigital.com/about/ \u0026https://app.completeaccess.audio/installers\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nThe Slate Digital Connect App installs a helper tool during installation. The\nhelper tool namely `com.slatedigital.connect.privileged.helper.tool` is installed\ninto `/Library/PrivilegedHelperTools`. It offers the XPC service\n`com.slatedigital.connect.privileged.helper.tool2`.\n\nIt was found that the client validation of the XPC service is insufficient.\nThe following snippet of the decompiled function \"isValidClient\" shows that\nonly a check regarding the subject.OU of the certificate is performed. It is\nnot verified that this certificate is signed by Apple.\n\n-----------------------------------\n100003050            if (_SecRequirementCreateWithString(\n100003050                    @\"certificate leaf[subject.OU] = \"3F5JHDQ8FZ\"\", 0, \u0026cf_2))\n100003054                goto label_100003068;\n-----------------------------------\n\nThis can be exploited by creating a self-signed certificate for code signing.\nThis enables attackers to craft their own self-signed certificate with the\ncorresponding subject.OU.\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nThe function \"isValidClient\" gets the code signing information of the\nconnecting process by using its PID:\n-----------------------------------\n100002fbc        SecRequirementRef cf_2 = nullptr;\n100002fcc        SecCodeRef var_28 = nullptr;\n100002fd4        int32_t pid = _xpc_connection_get_pid();\n100002fe0        CFAllocatorRef allocator = *(uint64_t*)_kCFAllocatorDefault;\n100002ff4        CFNumberRef values = _CFNumberCreate(allocator, kCFNumberSInt32Type, \u0026pid);\n100003014        CFDictionaryRef cf = _CFDictionaryCreate(allocator, _kSecGuestAttributePid,\n100003014            \u0026values, 1, nullptr, nullptr);\n100003038        bool z;\n100003038\n100003038        if (!_SecCodeCopyGuestWithAttributes(nullptr))\n100003038            z = !var_28;\n100003038        else\n100003038            z = true;\n100003038\n10000303c        int64_t result;\n10000303c        SecRequirementRef cf_1;\n-----------------------------------\n\nThis is considered not secure, since it is possible to exploit this case\nby exploiting PID reuse.\n\n\nProof of concept:\n-----------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nTo exploit this issue a rogue code signing certificate must be created:\n-----------------------------------\nopenssl genrsa -out codesign.key 4096\n\nopenssl req -new -x509 \\\n  -key codesign.key \\\n  -out codesign.crt \\\n  -days 3650 \\\n  -subj \"/CN=My Self Signed Code Cert/OU=3F5JHDQ8FZ/O=Test Org/C=US\" \\\n  -addext \"keyUsage=digitalSignature\" \\\n  -addext \"extendedKeyUsage=codeSigning\"\n\nopenssl pkcs12 -export \\\n  -inkey codesign.key \\\n  -in codesign.crt \\\n  -out codesign.p12\n-----------------------------------\n\nThis codesign.p12 certificate can then be imported into the keychain.\nThe following C code has been crafted to exploit the PrivilegedHelperTool:\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThis code was compiled by:\n-----------------------------------\nclang -o slateExploit main.c\n-----------------------------------\n\nand then signed with the crafted certificate created before:\n-----------------------------------\ncodesign --sign \"My Self Signed Code Cert\" \\\n         --force \\\n         slateExploit\n-----------------------------------\n\nThis executable can then be transferred to a target device and be executed as\nshown in the screenshot ExploitProof.png\n\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nTo exploit the insecure client validation via PID, the following Objective C\ncode can be used. The code first sends the desired XPC message and then\nquickly changes the process to the benign binary, leading to the PID,\nwhich will be used to check if the client should be allowed to connect\nto the service or not, pointing to the benign client.\n\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThe code can be compiled using clang:\n-----------------------------------\nclang -o slatepidexploit -framework foundation pidReuseSlate.c\n-----------------------------------\n\nThe pid reuse attack will then be performed and the command defined\nin the XPC message will be executed by root. This again enables several\nvectors for local privilege escalation.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.37.0\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-02-02: Contacting vendor by answering to the email received when\n            creating a ticket. No response.\n2026-02-24: Contacting vendor again through \ntickethttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-04-07: Contacting vendor viahelpdesk () slatedigital com; No response.\n2026-04-28: Tried contactingprivacy () slatedigital com, email seems to not exist:\n            \"Your message dated on 28 Apr 2026 07:52:04 -0000 toprivacy () slatedigital com\n            couldn\u0027t be delivered due to the following error:\n            5.1.0 - Unknown address error 550-\u00275.4.1 Recipient address rejected:\n            Access denied\"\n2026-04-28: Contactinginfo () audiotonix com; No response.\n2026-06-10: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/7"
        },
        {
          "url": "https://app.completeaccess.audio/installers"
        },
        {
          "url": "https://app.completeaccess.audio/installers,https://slatedigital.com/"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://slatedigital.com/about/"
        },
        {
          "url": "https://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260610-0 :: Local Privilege Escalation in Slate Digital Connect (macOS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24066",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24067",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0366",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7",
            "automated": true,
            "contentSha256": "4296eee822e8b196734ef37c00e2a72fc22b617ce67067d8b74fe4d9f3099418",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-10T10:34:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0366"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0366"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}