PULSEUnderground Intel

EN VIVO16señales / 24h

FEED

ransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerceransomaoqin reclama a The Tidewater Inn · US · Hospitalityransomdark project reclama a The CCMC · CAransombravox reclama a World Wide Fittings · US · Manufacturingransomakira reclama a Galorath · US · Professional Servicesransomakira reclama a Replogle Globes · US · Manufacturingransomakira reclama a Paragon Mechanical · Manufacturingransomemperador reclama a Carsem · MY · Manufacturingransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerceransomaoqin reclama a The Tidewater Inn · US · Hospitalityransomdark project reclama a The CCMC · CAransombravox reclama a World Wide Fittings · US · Manufacturingransomakira reclama a Galorath · US · Professional Servicesransomakira reclama a Replogle Globes · US · Manufacturingransomakira reclama a Paragon Mechanical · Manufacturingransomemperador reclama a Carsem · MY · Manufacturing

← Todos los CVEs

CVE Watch13 nov 2026

CVE-2026-95377

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, V

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-78

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal. The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.

Referencias oficiales

www.zenitel.comhttps://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-43874—

———: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.3h CVE-2026-1291287.8 ALT

———Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys.8h CVE-2026-1291248.1 ALT

———C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.3h CVE-2026-95615—

———OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.5h CVE-2026-1038139.1 CRÍ

———Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance.4h CVE-2026-1289088.8 ALT

———OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.10h