[0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)
Unauthenticated zip-slip in Auerswald COMmander 6000 firmware 8.6D yields root code execution.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #pbx
FreePBX security advisory (AV26-973)
Canadian Cyber Centre advisory AV26-973 lists vulnerable FreePBX modules with fixed versions available in the 16.x and 17.x release lines.
Scans Targeting Hospitality Applications, (Wed, Sep 16th)
Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
5
Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
2