https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:47:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280682 EUVD-2026-280682 https://cve.radiocsirt.org/vuln/euvd-2026-280682 https://cve.radiocsirt.org/vuln/fkie_cve-2014-125121 <p>Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.</p> <p>Once authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c &#34;debug monitor on&#34; triggers execution of the attacker&#39;s payload as root. This allows full system compromise.</p> <p>Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.</p> <p>Once authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c &#34;debug monitor on&#34; triggers execution of the attacker&#39;s payload as root. This allows full system compromise.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2014-125121 https://cve.radiocsirt.org/vuln/ghsa-wwvj-rx6h-pgx7 <p>Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.</p> <p>Once authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c &#34;debug monitor on&#34; triggers execution of the attacker&#39;s payload as root. This allows full system compromise.</p> <p>Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.</p> <p>Once authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c &#34;debug monitor on&#34; triggers execution of the attacker&#39;s payload as root. This allows full system compromise.</p> https://cve.radiocsirt.org/vuln/ghsa-wwvj-rx6h-pgx7