CVE sync 2026-11-13T07:31:25Z
This commit is contained in:
Vulnerability Bot committed
1 parent
355ea74f98
commit
50d02cdbe9
6 files changed
+213
-552
No files matched your search
@@ -8,16 +8,16 @@
|
||||
"assignerShortName": "NETGEAR",
|
||||
"dateReserved": "2026-06-09T02:46:41.216Z",
|
||||
"datePublished": "2026-10-13T14:42:50.698Z",
|
||||
"dateUpdated": "2026-10-16T14:10:44.857Z"
|
||||
"dateUpdated": "2026-11-13T06:43:03.326Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
|
||||
"shortName": "NETGEAR",
|
||||
"dateUpdated": "2026-10-16T14:10:44.857Z"
|
||||
"dateUpdated": "2026-11-13T06:43:03.326Z"
|
||||
},
|
||||
"title": "Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models",
|
||||
"title": "An insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models",
|
||||
"datePublic": "2026-10-13T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
@@ -99,12 +99,12 @@
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.",
|
||||
"value": "An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>\n\n</p><p>An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.</p>"
|
||||
"value": "<p>An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -207,12 +207,12 @@
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\n\n\n\n V2.3.4.12 https://www.netgear.com/support/product/cax30/ \n\n\n\n\n\n\nRAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\n\n\n\n V1.0.14.108 https://www.netgear.com/support/product/rax30/ \n\n\n\n\n\n\nRAX5 (EoS) 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/ \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.",
|
||||
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\n\n\n\n V2.3.4.12 https://www.netgear.com/support/product/cax30/ \n\n\n\n\n\n\nRAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\n\n\n\n V1.0.14.108 https://www.netgear.com/support/product/rax30/ \n\n\n\n\n\n\nRAX5 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/ \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>CAX30</b> Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/cax30/\"><span>V2.3.4.12</span></a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/rax30/\">V1.0.14.108</a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX5 (EoS)</b> 4-Stream AX1600 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax5/\">V1.0.5.34</a></td></tr><tr><td><b>RAXE300</b> Nighthawk AXE7800 Tri-Band WiFi 6E Router</td><td><a href=\"https://www.netgear.com/support/product/raxe300/\">V1.0.10.72</a></td></tr></tbody></table><p>Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.</p>"
|
||||
"value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>CAX30</b> Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/cax30/\"><span>V2.3.4.12</span></a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/rax30/\">V1.0.14.108</a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX5</b> 4-Stream AX1600 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax5/\">V1.0.5.34</a></td></tr><tr><td><b>RAXE300</b> Nighthawk AXE7800 Tri-Band WiFi 6E Router</td><td><a href=\"https://www.netgear.com/support/product/raxe300/\">V1.0.10.72</a></td></tr></tbody></table><p>Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "NetDEF",
|
||||
"dateReserved": "2026-10-30T18:11:52.731Z",
|
||||
"datePublished": "2026-11-12T18:07:42.693Z",
|
||||
"dateUpdated": "2026-11-12T18:07:42.693Z"
|
||||
"dateUpdated": "2026-11-13T06:34:19.711Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -77,7 +77,7 @@
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up.\n\n\nA BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can cause one of the following:\n\n * If the neighbor announced Graceful Restart support: bgpd crashes shortly after the session is closed (after the neighbor's announced restart time plus one keepalive interval), taking down all BGP sessions on the router. The neighbor can repeat this each time bgpd restarts.\n * Otherwise: the session stays stuck in the Established state. The neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator runs \"clear bgp <neighbor>\".\n\nThe neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior.\n\n\nRequired configuration: no special configuration is needed. Any BGP neighbor with an established session can trigger the issue under default settings, for example:\n\n router bgp 65001\n neighbor 192.0.2.2 remote-as 65002\n\nGraceful Restart helper mode, which leads to the crash, is enabled by default. With default timers (keepalive 60s, hold time 180s), the session is closed about 6 minutes after the neighbor stops reading."
|
||||
"value": "In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
@@ -140,7 +140,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "57a55968-44ac-464c-a794-6ba3baad09c4",
|
||||
"shortName": "NetDEF",
|
||||
"dateUpdated": "2026-11-12T18:07:42.693Z"
|
||||
"dateUpdated": "2026-11-13T06:34:19.711Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
|
||||
@@ -0,0 +1,133 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-128424",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-13T05:56:28.939Z",
|
||||
"datePublished": "2026-11-13T06:09:19.627Z",
|
||||
"dateUpdated": "2026-11-13T06:41:03.642Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Kroxylicious-authorizer-acl: kroxylicious: acl rule file regex escapes are stripped, broadening 'matching' authorization rules",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\\d` and `\\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "streams for Apache Kafka 3",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "kroxylicious-authorizer-acl",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:amq_streams:3"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-128424",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572937",
|
||||
"name": "RHBZ#2572937",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/kroxylicious/kroxylicious/issues/5236"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/kroxylicious/kroxylicious/pull/5294"
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-10-28T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-863",
|
||||
"description": "Incorrect Authorization",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-863: Incorrect Authorization",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Until a fixed release is available, write regex escapes with doubled backslashes (for example `/orders\\\\.v1/`), audit existing `matching` rules for unintended matches, and prefer exact or `like` predicates where regex matching is not required."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-10T00:00:00.000Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-10-28T00:00:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank Carles Arnal (IBM) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-13T06:41:03.642Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user