Threats Tagged 'local'

A set of three vulnerabilities were discovered in the BigWave driver on the Pixel 9 device, which is accessible from the mediacodec sandboxed context. One of these bugs enables a use-after-free condition that allows escaping the mediacodec sandbox and achieving arbitrary kernel read/write on the Pixel 9. The vulnerabilities were fixed on January 5, 2026. The BigWave driver accelerates AV1 decoding and is exposed to userland processes in the mediacodec SELinux context, which is intended to be constrained. The use-after-free arises from a race condition between ioctl processing and a worker thread handling hardware jobs, leading to a kernel object being freed while still referenced.

New York State has awarded over $9 million in grants to 153 drinking water and wastewater systems to enhance their cybersecurity defenses. This initiative follows a recent multistate cyber campaign targeting water infrastructure, which caused operational disruptions in several states but did not affect New York utilities publicly. The funding supports cybersecurity assessments, upgrades, and compliance with new state cybersecurity standards for utilities. The campaign involved attacks on operational technology systems, including programmable logic controllers, and is suspected to be linked to Iranian threat actors. Federal agencies recommend removing exposed OT devices from the internet and securing remote access. The grants aim to improve resilience and compliance with mandatory cybersecurity measures for critical water infrastructure.

This content discusses the evolving cybersecurity compliance landscape for U.S. water and wastewater utilities amid increasing federal and state regulatory enforcement. It highlights the legal requirements under the America’s Water Infrastructure Act (AWIA) 2013 for community water systems to certify Risk and Resilience Assessments and Emergency Response Plans addressing cyber threats. The EPA is actively enforcing existing authorities and providing updated guidance and tools to improve cybersecurity posture. States like New York have implemented binding cybersecurity regulations for wastewater facilities, including mandatory incident reporting and access controls. The discussion is framed by recent cyber attacks on water utilities, underscoring the urgency of compliance and risk management.

Canada’s Bill C-8, the Critical Cyber Systems Protection Act (CCSPA), mandates critical infrastructure operators to report cyber incidents within 72 hours and imposes heavy financial penalties for non-compliance. The law targets sectors such as telecommunications, energy, transportation, and banking, requiring formal cybersecurity programs and mitigation of supply chain risks. The act highlights the operational challenge of detecting and reporting breaches rapidly in environments where IT and OT systems converge. Bill C-8 emphasizes the need for unified visibility across IT, OT, and IoT assets to meet the strict reporting deadline and avoid penalties. Solutions that combine active and passive monitoring can help eliminate blind spots and prioritize vulnerabilities that threaten physical safety and uptime. The legislation aims to enhance national critical infrastructure security by enforcing timely incident reporting and comprehensive asset management.

CriticalNewsCanada#local#web#rce

This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18284.

This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-18268.

This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18270.

This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2026-18273.

This vulnerability allows local attackers to delete arbitrary files on affected installations of TrendLife Cleaner One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.6. The following CVEs are assigned: CVE-2026-62660.

CVE-2026-44093 is a local privilege escalation vulnerability in the init-script for user-applications. It allows a low-privileged local user to execute arbitrary commands as root, potentially leading to full system compromise. The vulnerability is related to improper neutralization of special elements used in OS commands (CWE-78). No patch or remediation information is currently available, and there are no known exploits in the wild at this time.