Hyperglass flaws can become pre-auth RCE on exposed ISP installs
Original title: Rooting ISPs and Hosting Providers with Hyperglass
The note names no CVE, affected versions, or fix, and does not say any provider was compromised.
An oss-security post says hyperglass has operating-system code-execution flaws that can be turned into pre-authentication remote code execution. The poster says many ISPs and hosting providers are at risk because they expose hyperglass to the internet. Research from hunting through exploitation is credited to DS; the poster says they only validated it.
Unconfirmed: The post does not say any ISP or host was actually compromised.
- The write-up is linked at hyperpwn.xyz and was posted to LET first.
- No CVE identifier, affected range, or fixed version is given.
- The poster attributes the research to DS and claims only to have validated it.
Impact: pre-authentication remote code execution on exposed hosts
| Product | Affected |
|---|---|
| hyperglass | — |
- 1.Keep hyperglass instances off the public internet until a fix is confirmed.
From the original article
Posted by factoid on Nov 10 https://hyperpwn. xyz/ Note: All the research, from hunting to exploitation was done by DS. All I did was validate.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.