RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 has an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service exposed on TCP port 2001. This flaw allows remote attackers to send malicious serialized payloads to achieve remote code execution as NT AUTHORITY\SYSTEM, fully compromising the host.
A path traversal vulnerability exists in the certificate.deleteCertificate JSON-RPC method of the turbineweb web interface in certain Zenitel devices. Authenticated administrators can exploit this flaw by providing a relative path in the file_name parameter to delete arbitrary files as root. This can lead to denial of service or device inoperability by removing critical system files, including security-related files such as firewall rules or certificate trust stores.
An OS command injection vulnerability exists in the audio messages API of Zenitel Connect versions before 1.11.0. This flaw allows remote authenticated users to execute arbitrary operating system commands as root within the hiatus application container by exploiting the filename parameter in the /api/system/audio_messages endpoint.
A vulnerability in Zenitel Connect before version 1.11.0 allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host. This occurs because the host configuration watcher applies a rsyslog configuration file from a shared data volume, which can be crafted maliciously.
Cudy TR3000 devices running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by uploading specially crafted OpenVPN private or tls-auth keys. The attack involves closing the inline key block prematurely and injecting directives that bypass security restrictions, allowing OpenVPN to execute arbitrary commands as root.
sysPass versions 3.0.1 through 3.2.11 have an authentication bypass vulnerability that allows unauthenticated attackers to reinstall the application by sending a POST request to the install handler. This bypass occurs because the install handler does not verify if the application is already installed. Exploitation enables attackers to overwrite configuration files, redirect the application to an attacker-controlled database, create administrator accounts, and execute arbitrary commands via crafted serialized gadget chains.
Cudy TR3000 devices running firmware versions before 2.5.42 have a mass assignment vulnerability in the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options. Specifically, attackers can enable the VPN and set a malicious 'up' option that is executed by the openvpn-hotplug wrapper with root privileges via /bin/sh.
Zenitel Connect versions before 1.11.0 expose production JavaScript source map files through the web interface without requiring authentication. This exposure allows remote attackers to access the complete front-end source code, revealing API usage and internal client logic.
Cudy TR3000 devices running firmware versions before 2.5.42 have a vulnerability in the dnsmasq configuration that allows authenticated administrators to inject malicious directives. This is achieved by embedding a newline character in the net.set_dhcp leasetime field, enabling attackers to append or insert lines in the dnsmasq configuration file. Such manipulation can alter DNS responses for LAN clients or disrupt the dnsmasq service entirely.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by injecting newline characters into the reboot_time parameter, allowing them to add arbitrary commands to the root crontab. This leads to command execution with root privileges.
Cudy TR3000 devices running firmware versions before 2.5.42 have an option injection vulnerability. Authenticated administrators can exploit this flaw by injecting arbitrary pppd options through crafted L2TP credentials. This is achieved by embedding quotes and newlines in usernames or passwords submitted to the net.set_wan RPC method, which writes these inputs into a pppd options file. The vulnerability allows attackers to add options such as logfile to the root pppd process, potentially impacting system integrity and availability.
Dell PowerStore appliances contain an OS Command Injection vulnerability (CVE-2026-103813) that allows an authenticated user with limited privileges to potentially escalate their privileges to root on the appliance. This vulnerability has a high severity score and could lead to full compromise of the affected system.
Cudy TR3000 routers running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by importing a malicious OpenVPN client configuration containing specially crafted tls-verify or ipchange directives. These directives bypass an incomplete denylist and allow execution of root commands when the router connects to the attacker-controlled VPN endpoint. This vulnerability enables full control over the device with high impact on confidentiality, integrity, and availability.
Zenitel Connect versions before 1.11.0 have a vulnerability in the login flow where different error messages are returned depending on whether a submitted username exists. This behavior allows remote attackers to enumerate valid user accounts by sending crafted login requests.
A buffer overflow vulnerability exists in the handling of EDID Display-Range descriptors in X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26. This flaw could allow a malicious monitor to crash the X server or potentially execute code with limited privileges. The vulnerability has a high severity rating with a CVSS score of 7.8.
A Ruby object-document mapper fails to apply automatic field-level encryption to certain fields when using class inheritance in the data model. As a result, values intended for encryption are stored in readable form in the database without any error or warning. This allows a database account with read-only access to the application's collections, but no access to the encryption key store, to obtain sensitive plaintext data.
Zenitel Connect versions before 1.11.0 have a vulnerability in their web interface where an integration iframe is loaded without sandboxing or origin restrictions. This flaw allows remote attackers to present phishing content to authenticated users by crafting a malicious frame source. The vulnerability has a medium severity rating with a CVSS score of 5.1.
A vulnerability in the Mongoid ODM's automatic client-side encryption schema generation can cause values intended for encryption to be stored in cleartext when multiple models share the same storage location. This occurs without any error or warning, potentially exposing sensitive data to users with read-only database access but no encryption keys.
Zenitel Connect versions before 1.11.0 implement a per-account lockout mechanism on repeated failed login attempts. This behavior allows remote attackers to cause a denial of service by repeatedly submitting failed login requests for known or guessed usernames, temporarily locking targeted user accounts from accessing the web interface. The vulnerability does not affect intercom call handling functionality.
Zenitel Connect versions before 1.11.0 contain a vulnerability in the WAMP-CRA authentication path that allows unlimited authentication attempts without account lockout or rate limiting. This flaw enables remote attackers to guess user passwords via brute force. However, exploitation is limited by a strict password policy requiring at least 12 characters with mixed character types. The vulnerable authentication path is removed in version 1.11.0.