The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
sysPass versions 3.0.1 through 3.2.11 have an authentication bypass vulnerability in the install/install handler. This flaw allows unauthenticated attackers to reinstall an already-installed instance without checking if the application is already installed. Exploitation enables overwriting configuration files, redirecting the application to attacker-controlled databases, creating administrator accounts, and executing commands via serialized gadget chains.
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.
CVE-2026-126818 is a vulnerability in the MongoDB Ruby Driver where automatic field-level encryption is not applied to certain fields when using class inheritance in the data model. This results in sensitive data being stored in plaintext in the database without any error or warning. An attacker with read-only access to the database collections but no access to the encryption key store could read these sensitive values.
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.
CVE-2026-123635 is a resource management vulnerability in elixir-grpc grpc_server versions from 1.0.0 up to but not including 1.1.0. It allows a client to stall all subsequent calls on a shared HTTP/2 connection by sending calls that the server refuses while their DATA frames are still in flight. This causes the connection's flow-control window to be depleted, blocking further request bodies on that connection until deadlines expire. Other connections remain unaffected. The issue is fixed in version 1.1.0.
CVE-2026-126817 is a vulnerability in the MongoDB Ruby Driver's Mongoid ODM automatic client-side encryption schema generation. When multiple models map onto the same storage location, values intended for encryption may be stored in cleartext without any error or warning. This allows a user with read-only database access, but no encryption keys, to read sensitive data in clear form.
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.
Cudy TR3000 versions before 2.5.42 have a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading specially crafted OpenVPN private or tls-auth keys. The vulnerability arises from improper encoding or escaping of output, enabling attackers to inject directives that bypass security restrictions and execute arbitrary code with root privileges.
Cudy TR3000 devices prior to version 2.5.42 have a mass assignment vulnerability in the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options, including enabling malicious commands executed as root via the openvpn-hotplug wrapper. The vulnerability is fixed in version 2.5.42.
CVE-2026-129102 is a command injection vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device versions before 2.5.42. Authenticated administrators can exploit improper neutralization of CRLF sequences in the IPsec keyexchange field of the vpn.set_conf RPC method to execute commands as root. This is achieved by injecting newlines to append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin executes with root privileges when an attacker-controlled peer establishes the CHILD_SA.
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
CVE-2026-129104 is a vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences allowing authenticated administrators to inject dnsmasq configuration directives via the net.set_dhcp leasetime field. This can lead to DNS manipulation or service disruption on LAN clients. The issue is fixed in version 2.5.42.
CVE-2026-129105 is a high-severity vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences, allowing authenticated administrators to inject arbitrary pppd options via crafted L2TP credentials. This can lead to unauthorized modification of pppd options files and potentially affect the root pppd process. The issue is fixed in version 2.5.42.