📋 ADVISORIES
Critical Stack Buffer Overflow in Siemens Desigo CC via OpenSSL Parsing (CVE-2025-15467)
Siemens Desigo CC is vulnerable to a critical OpenSSL stack buffer overflow allowing DoS or remote code execution.- Applies to Siemens Desigo CC versions V7 all, V8 all, and V9 versions below 9.0.1
- Vulnerability is a stack-based buffer overflow in OpenSSL when parsing CMS AuthEnvelopedData with AEAD ciphers like AES-GCM
- Attack exploits oversized Initialization Vector in ASN.1 parameters causing out-of-bounds write before authentication
- No valid key material required to trigger overflow; leads to denial of service or potential remote code execution
- CVSS 3.1 base score 9.8 (critical); Siemens has released patches for V8 and V9, with further fixes planned
Apple iOS 26.6 Fixes Kernel Code Execution, Root Access, and Sandbox Escape Flaws
Apple released iOS 26.6 to fix multiple critical vulnerabilities including kernel code execution and sandbox escapes.- Applies to iPhone 11 and later, and supported iPad models
- Fixes kernel vulnerabilities enabling arbitrary code execution, root access, and sandbox escape
- Critical flaw in AVEVideoEncoder (CVE-2026-64747) allows kernel code execution via buffer overflow
- Other fixes include kernel memory corruption (CVE-2026-28931), root privilege escalation (CVE-2026-43723), and sandbox escapes (CVE-2026-64740, CVE-2026-28973)
- Vulnerabilities exploitable via malicious apps, crafted files, or malicious network servers
Sources Coverage: cybersecuritynews.com · via Cyber Security NewsSiemens Mendix Runtime Documentation Gap Leads to Overly Permissive Access Rules
Siemens Mendix Runtime documentation gap causes insecure access rule configurations exposing user data.- Applies to Siemens Mendix Runtime versions: all versions affected
- Vulnerability involves inadequate documentation of System.User entity access rules
- Developers may unknowingly configure overly permissive access, exposing sensitive user data
- Common misconfiguration allows anonymous user role to access all System.User records without explicit rights
- Attack vector: insecure inherited permissions due to documentation gap, enabling privilege escalation
siemens-simatic-s7-plcsim-advanced-dos — CISA Advisories
siemens-simatic-s7-1500-firmware-multiple-vulnerabilities — CISA Advisories
abb-knx-update-tool-vulnerability — CISA Advisories
🕵️ RESEARCH & DEEP DIVES
Over 24,000 Internet-Exposed BMCs Leak IPMI Password Hashes Before Login
More than 24,000 internet-exposed BMCs leak IPMI password hashes due to a protocol flaw.- Applies to over 36,000 internet-exposed Baseboard Management Controllers (BMCs) running IPMI v2.0
- 24,650 BMCs disclose password-derived authentication hashes before login, enabling offline cracking
- Vulnerability stems from CVE-2013-4786, an inherent flaw in IPMI v2.0 allowing HMAC retrieval via UDP port 623
- Exposed hashes include weak, factory-set, or predictable passwords recoverable with GPU-accelerated cracking
- Affected hardware includes modern Supermicro and HPE servers used by GPU providers and AI data centers
Sources Coverage: thehackernews.com · via The Hacker NewsMikroTik RouterOS and Cloud Hosted Router vulnerable to password guessing (CVE-2026-16347)
CVE-2026-16347
MikroTik RouterOS and Cloud Hosted Router allow rapid password guessing due to insufficient authentication attempt restrictions.- Applies to all versions of MikroTik RouterOS and Cloud Hosted Router worldwide
- Vulnerability in API authentication lacks effective rate-limiting and account lockout
- Attackers can perform high-volume concurrent login attempts to guess passwords
- Exploitation could lead to unauthorized administrative access
- No fix currently available; vulnerability scored 8.8 (CVSS v3.1) high severity
igloohome Smart Lock Android App Vulnerable to Unauthorized Access via Sensitive Info Exposure (CVE-2026-16581)
CVE-2026-16581
igloohome Smart Lock Mobile App versions 3.2.3 and prior expose sensitive info enabling unauthorized access.- Applies to igloohome Smart Lock Mobile Application for Android, version 3.2.3 and earlier
- Vulnerability involves inclusion of sensitive information in source code accessible without authentication
- Allows unauthorized actors to access backend functions or services lacking proper authentication controls
- Attack vector is remote network access without user interaction, exploiting exposed sensitive data
- CVSS v3.1 base score is 5.3 (Medium severity), CVSS v4.0 score is 6.9 (Medium severity)
Camaleon CMS 2.1.1-2.9.1 Authenticated RCE via select_eval Custom Field (CVE-2026-66748)
CVE-2026-66748
Camaleon CMS versions 2.1.1 to 2.9.1 have an authenticated remote code execution vulnerability.- Applies to Camaleon CMS versions 2.1.1 through 2.9.1
- Allows users with custom_fields manage permission to execute arbitrary Ruby code
- Vulnerability exploited by supplying malicious Ruby expression via select_eval custom field
- Code executed with web server process privileges during post edit page rendering
Tengu Botnet Reboots Linux Devices to Maintain Persistence After Process Kill
Tengu botnet reboots compromised Linux devices using hardware watchdog to maintain persistence.- Targets Linux devices via Telnet credential brute force attacks
- Uses hardware watchdog to trigger reboot if main malware process is killed
- Supports 25 DDoS methods, SOCKS5 proxy, shell commands, and system data collection
- Employs multiple persistence methods including fake systemd services and immutable binaries
- Communicates with C2 server at 64.89.163.8:9931 using encrypted commands and can update itself
🔓 CVEs & KEV
- Other: 19 CVEs (worst 8.2)