---METADATA---
VENDOR: osrg
PRODUCT: GoBGP
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the osrg GoBGP software, potentially allowing for unexpected behavior or unauthorized access.

Executive Summary:
A high-severity vulnerability in osrg GoBGP poses a significant risk to network routing infrastructure and requires immediate investigation and patching.

Vulnerability Details

CVE-ID: CVE-2026-7735

Affected Software: osrg GoBGP

Affected Versions: See vendor advisory for affected versions

Vulnerability: A vulnerability was identified in GoBGP versions up to 4. While specific technical details are limited, users should refer to official vendor advisories to understand the nature of the flaw.

Business Impact

With a CVSS score of 7.3, this vulnerability could potentially lead to routing instability or unauthorized access to network control planes. Given the critical role of BGP in network infrastructure, the impact of a successful exploit could be severe, including service disruption or traffic redirection.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the osrg project or the relevant distribution maintainers.

Proactive Monitoring: Monitor BGP peering logs for anomalous entries or unexpected session resets and review routing tables for unauthorized changes.

Compensating Controls: Implement strict BGP filtering (prefix lists/route maps) and ensure control plane protection (e.g., TTL security, ACLs) is active for all BGP-speaking devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing GoBGP must prioritize reviewing vendor security advisories and applying the latest patches to maintain the integrity of their network routing infrastructure.

---METADATA---
VENDOR: VetCoders
PRODUCT: mcp-server-semgrep
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability has been detected in VetCoders mcp-server-semgrep, potentially impacting its operation or security.

Executive Summary:
A high-severity vulnerability in the VetCoders mcp-server-semgrep tool requires immediate attention to mitigate potential security risks.

Vulnerability Details

CVE-ID: CVE-2026-7446

Affected Software: VetCoders mcp-server-semgrep

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability affects the mcp-server-semgrep component; users should consult the vendor's security guidance for specific technical details.

Business Impact

With a CVSS score of 7.3, this is a high-severity issue. Exploitation could potentially allow attackers to interfere with automated security scanning processes, potentially masking malicious code or gaining access to the environment where the server is deployed.

Remediation Plan

Immediate Action: Update mcp-server-semgrep to the latest version provided by VetCoders.

Proactive Monitoring: Monitor the output and logs of the semgrep server for signs of tampering or unexpected behavior.

Compensating Controls: Run security tools in restricted environments with limited permissions to minimize the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability.

Analyst Recommendation

Organizations using this tool for automated code analysis should prioritize updating to the latest version to ensure the integrity of their security scanning pipeline.

---METADATA---
VENDOR: Tushar
PRODUCT: Hotel Management System
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Tushar Hotel Management System contains a security vulnerability that requires immediate attention.

Executive Summary:
A high-severity security vulnerability has been identified in the Tushar Hotel Management System, potentially allowing for unauthorized access or system impact.

Vulnerability Details

CVE-ID: CVE-2026-6142

Affected Software: Tushar Hotel Management System

Affected Versions: See vendor advisory for affected versions

Vulnerability: A vulnerability exists in the Tushar Hotel Management System; however, specific technical details regarding the affected function or authentication requirements remain limited.

Business Impact

The CVSS score of 7.3 indicates a high level of risk. Potential consequences include unauthorized access to guest or booking data, leading to regulatory compliance issues (e.g., GDPR/PII), reputational damage, and potential service interruption.

Remediation Plan

Immediate Action: Apply all security updates as soon as they are made available by the vendor.

Proactive Monitoring: Review application access logs for any anomalous behavior or unauthorized access attempts to the management system.

Compensating Controls: Implement WAF rules to monitor for common web-based attack patterns and restrict network access to the application to authorized users only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score warrants prompt attention to security advisories.

Analyst Recommendation

While an exploit is not currently public, the high severity of the vulnerability requires proactive management. Organizations should monitor the vendor's advisory channels and apply patches as soon as they are released to ensure the security of their hotel management environment.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
WWBN AVideo contains a high-severity security vulnerability that could be exploited to gain unauthorized access to the video platform's infrastructure.

Executive Summary:
A high-severity vulnerability in the WWBN AVideo platform could allow unauthorized access or control, posing a significant risk to hosted video content and user data.

Vulnerability Details

CVE-ID: CVE-2026-43873

Affected Software: WWBN AVideo

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a security flaw within the AVideo platform that may allow an attacker to bypass security mechanisms. Exploitation of this vulnerability could lead to unauthorized administrative access or the compromise of server-side operations.

Business Impact

With a CVSS score of 7.5, this vulnerability is a significant concern for organizations relying on AVideo for media distribution. Potential impacts include unauthorized access to video content, leakage of user data, and the potential for platform defacement or service disruption, all of which could severely damage an organization's digital presence.

Remediation Plan

Immediate Action: Immediately update the AVideo platform to the latest version as specified in the vendor's security documentation.

Proactive Monitoring: Audit server access logs for anomalous activity and monitor administrative interfaces for unauthorized configuration changes.

Compensating Controls: Use a Web Application Firewall (WAF) to block suspicious requests and enforce strict access controls on the administrative panel of the AVideo installation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity justifies prompt remediation to prevent potential data compromise.

Analyst Recommendation

Organizations using the AVideo platform should prioritize patching. Given the potential for unauthorized access to the platform's media and user database, applying the vendor-provided security updates is the most effective way to mitigate this risk.

---METADATA---
VENDOR: Open edX
PRODUCT: Open edX Platform
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Open edX Platform contains a high-severity vulnerability that may allow for unauthorized access or system manipulation due to insufficient security controls.

Executive Summary:
A high-severity vulnerability in the Open edX Platform could allow unauthorized access to the learning management system, threatening the integrity of educational and user data.

Vulnerability Details

CVE-ID: CVE-2026-42858

Affected Software: Open edX Platform

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability relates to the core functionality of the Open edX platform. While specific technical details are pending, it involves a security flaw that could be exploited to bypass existing access controls or manipulate platform operations.

Business Impact

With a CVSS score of 8.5, this vulnerability poses a high risk to educational institutions and organizations using Open edX. Successful exploitation could lead to unauthorized access to user records, intellectual property, or the ability to modify course content, resulting in significant reputational and legal consequences.

Remediation Plan

Immediate Action: Review the Open edX security advisories and apply the latest security patches to all production instances.

Proactive Monitoring: Monitor logs for unauthorized administrative actions, unusual API calls, or attempts to access data outside of standard user privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to inspect incoming traffic for signs of platform-level manipulation or unauthorized access attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score, however, indicates that the vulnerability is significant and requires immediate attention to prevent potential exploitation.

Analyst Recommendation

Administrators should treat this vulnerability as a high priority. Given the platform's role in delivering critical educational services, it is essential to monitor vendor updates closely and apply the necessary patches to maintain platform integrity and data security.

---METADATA---
VENDOR: NuGet
PRODUCT: NuGetGallery
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: versions
---END_METADATA---

Description Summary:
A cross-package metadata injection vulnerability in NuGetGallery allows for arbitrary blob writes and potential remote code execution via crafted .nuspec files.

Executive Summary:
A critical vulnerability in the NuGetGallery backend allows attackers to achieve remote code execution and arbitrary file manipulation through malicious metadata injection.

Vulnerability Details

CVE-ID: CVE-2026-39399

Affected Software: NuGet NuGetGallery

Affected Versions: See vendor advisory

Vulnerability: The vulnerability arises from insufficient input validation of .nuspec files and URI fragment injection. This allows an attacker to control resolved blob paths, resulting in RCE or unauthorized modification of repository content.

Business Impact

With a CVSS score of 9.6, this flaw poses a severe risk to the integrity of the software supply chain. Attackers could potentially inject malicious code into software packages, leading to widespread downstream compromise and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Ensure the NuGetGallery environment is updated to include the fix provided in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

Proactive Monitoring: Monitor repository logs for irregular package metadata patterns or unauthorized attempts to access or modify storage blobs.

Compensating Controls: Implement strict input validation and sandboxing for all package processing pipelines to restrict access to underlying storage containers.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate package metadata is a high-impact risk for any development environment. Administrators must verify the integrity of their NuGetGallery deployments and apply the necessary code patches immediately to mitigate the risk of supply chain attacks.

---METADATA---
VENDOR: Openlabs
PRODUCT: docker-wkhtmltopdf-aas
AFFECTED_VERSIONS: All versions up to and including commit 9f50579.
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the app.py component allows unauthenticated attackers to execute arbitrary commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas exposes systems to full remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-36576

Affected Software: Openlabs docker-wkhtmltopdf-aas

Affected Versions: All versions up to and including commit 9f50579.

Vulnerability: This is a command injection flaw (CWE-78) located in the app.py component. An unauthenticated attacker can exploit this by submitting a specially crafted POST request, which fails to properly neutralize special elements used in OS commands, resulting in arbitrary code execution.

Business Impact

The CVSS score of 9.8 confirms the extreme severity of this vulnerability. Successful exploitation permits an attacker to gain full control over the underlying host system, leading to total data compromise, lateral movement within the network, and potential disruption of critical business services.

Remediation Plan

Immediate Action: Upgrade to the latest version of docker-wkhtmltopdf-aas to ensure the vulnerable app.py component is patched.

Proactive Monitoring: Inspect application and system logs for suspicious POST requests containing shell metacharacters or unexpected system commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common command injection patterns in HTTP request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection vulnerabilities, organizations must prioritize patching this component. Ensure that any instance of docker-wkhtmltopdf-aas is updated immediately to prevent potential remote compromise of the server infrastructure.

---METADATA---
VENDOR: Realtek
PRODUCT: rtl819x Jungle SDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Realtek rtl819x Jungle SDK affecting the rtl8192cd Wi-Fi kernel driver, which may allow for unauthorized system impact.

Executive Summary:
The Realtek rtl819x Jungle SDK contains a high-severity flaw in the Wi-Fi kernel driver that could lead to unauthorized system-level access.

Vulnerability Details

CVE-ID: CVE-2026-36355

Affected Software: Realtek rtl819x Jungle SDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the rtl8192cd Wi-Fi kernel driver. It involves an improper handling of data within the driver, which may be exploited to compromise the stability or security of the host system.

Business Impact

The CVSS score of 7.7 reflects a high risk to organizations relying on hardware integrated with the Realtek SDK. Successful exploitation could result in the compromise of wireless communications or the host operating system, potentially leading to data exfiltration or denial of service.

Remediation Plan

Immediate Action: Update to the latest firmware or SDK version provided by the hardware manufacturer.

Proactive Monitoring: Monitor network infrastructure logs for abnormal Wi-Fi driver behavior or unexpected system reboots.

Compensating Controls: Restrict access to wireless management interfaces to trusted administrative subnets to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Hardware administrators must verify the SDK versions used in their wireless equipment and apply vendor-supplied patches promptly. Given the role of the kernel driver in system security, deferring this update is not recommended.

---METADATA---
VENDOR: MaxSite
PRODUCT: MaxSite CMS
AFFECTED_VERSIONS: Up to 109
---END_METADATA---

Description Summary:
A security flaw in MaxSite CMS up to version 109 presents a high-severity risk to the integrity of the content management system.

Executive Summary:
MaxSite CMS versions up to 109 contain a security vulnerability that could allow attackers to compromise the application's integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-3395

Affected Software: MaxSite CMS

Affected Versions: All versions up to and including 109

Vulnerability: A security flaw exists in the MaxSite CMS architecture. While the specific technical vector is not detailed in the summary, the vulnerability is categorized as high severity and impacts the core CMS functionality.

Business Impact

A successful exploit could result in unauthorized modifications to website content, potential data leakage, or service disruption. The CVSS score of 7.3 indicates a High severity level, suggesting that while exploitation may require specific conditions, the impact on business operations and reputation is significant.

Remediation Plan

Immediate Action: Upgrade MaxSite CMS to a version higher than 109 immediately to mitigate the identified security risks.

Proactive Monitoring: Monitor CMS administrative logs for unauthorized login attempts or unexpected changes to system configurations and file structures.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter suspicious traffic and enforce strong access control policies for the CMS administrative interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of a public exploit provides a window for administrators to patch before widespread scanning begins.

Analyst Recommendation

Organizations using MaxSite CMS should treat this as a high-priority update. Ensure that all CMS installations are moved to a supported, patched version to maintain a secure web presence.

---METADATA---
VENDOR: NLTK Project
PRODUCT: Natural Language Toolkit (NLTK)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Natural Language Toolkit (NLTK) Python library, impacting data processing and research environments.

Executive Summary:
The NLTK Python suite is affected by a high-severity vulnerability that could compromise the integrity of natural language processing workflows and the underlying host systems.

Vulnerability Details

CVE-ID: CVE-2026-33231

Affected Software: NLTK Project Natural Language Toolkit (NLTK)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the core processing modules of the NLTK library. While specific function names are withheld in the preliminary summary, the CVSS score of 7.5 suggests a risk involving unauthorized data manipulation or remote code execution, likely depending on how the toolkit handles untrusted datasets.

Business Impact

Compromise of the NLTK library can lead to the corruption of research data, unauthorized access to development environments, and potential lateral movement within an organization's AI/ML pipeline. The CVSS score of 7.5 justifies a High severity rating, as a successful exploit could disrupt critical data science operations and lead to the exposure of proprietary training models.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the NLTK project via pip or official distribution channels immediately.

Proactive Monitoring: Review Python application logs for anomalous errors during dataset loading or processing and monitor for unusual outbound network connections from NLTK-dependent services.

Compensating Controls: Utilize containerization or virtual environments to isolate NLTK processing tasks, limiting the potential blast radius of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. Given its presence in a widely used Python library, developers should proactively update their dependency requirements to mitigate risk.

Analyst Recommendation

Immediate patching is recommended for all environments utilizing the NLTK library. Security teams should ensure that all Python requirements files (e.g., requirements.txt, Pipfile) are updated to the secure version to prevent the introduction of this vulnerability into production environments.

Executive Summary:
A critical vulnerability has been identified in the Cybersecurity AI (CAI) framework, which could allow a remote attacker to take full control of an affected system. The flaw stems from the insecure handling of user-supplied data, enabling the execution of arbitrary commands without any user interaction or approval. This vulnerability poses a significant risk of complete system compromise, data theft, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-25130

Affected Software: Cybersecurity AI Multiple Products

Affected Versions: Versions up to and including 0.5.10

Vulnerability: The vulnerability is a critical argument injection flaw within the function tools of the Cybersecurity AI framework. The application improperly passes user-controlled input directly to system shell commands using subprocess.Popen() with shell=True. An attacker can craft input that includes malicious shell command arguments. Specifically, the find_file() tool, which is pre-approved as a "safe" command and requires no human-in-the-loop approval, can be exploited by injecting arguments like -exec to execute arbitrary commands, leading to Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.6. Successful exploitation grants an attacker full control over the host system, equivalent to the user running the CAI framework. The potential consequences include theft of sensitive data, deployment of ransomware, disruption of critical business operations, and using the compromised system as a pivot point to attack other internal network resources. The reputational damage to an organization relying on a compromised AI security product is also a significant risk.

Remediation Plan

Immediate Action: Immediately apply the vendor-supplied patch by updating all instances of Cybersecurity AI products to the latest version which contains the fix (referenced in commit e22a1220f764e2d7cf9da6d6144926f53ca01cde). After patching, review system and application logs for any signs of past exploitation attempts.

Proactive Monitoring: Monitor for suspicious process execution chains. Specifically, look for child processes spawned by the CAI application, such as find executing unexpected commands (e.g., sh, bash, curl, wget). Scrutinize network traffic originating from servers running the CAI framework for unusual outbound connections. Review shell command history and system audit logs for commands that may indicate a compromise.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Run the Cybersecurity AI application in a minimal-privilege, sandboxed, or containerized environment to limit the impact of a potential compromise.
• Implement strict input validation and sanitization at a network level using a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) to block requests containing shell metacharacters and suspicious command arguments like -exec.
• Restrict outbound network access from the host running the application to prevent attackers from easily exfiltrating data or downloading further malware.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date of January 30, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the straightforward nature of the argument injection flaw, it is highly probable that proof-of-concept (PoC) exploits will be developed and made public quickly. Organizations should assume that threat actors will begin actively scanning for and exploiting this vulnerability in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.6 and the risk of unauthenticated Remote Code Execution, this vulnerability represents a severe and immediate threat to the organization. We strongly recommend that the vendor's patch be applied to all affected systems with the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, its severity makes it a prime candidate for future inclusion. All remediation and monitoring actions should be initiated immediately to prevent a potential system compromise.

---METADATA---
VENDOR: kirilkirkov
PRODUCT: Ecommerce-CodeIgniter-Bootstrap
AFFECTED_VERSIONS: up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A deserialization and improper input validation vulnerability exists in kirilkirkov Ecommerce-CodeIgniter-Bootstrap, potentially allowing unauthenticated remote code execution or system impact.

Executive Summary:
A critical deserialization vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap application exposes unauthenticated users to potential remote system impact.

Vulnerability Details

CVE-ID: CVE-2026-14637

Affected Software: kirilkirkov Ecommerce-CodeIgniter-Bootstrap

Affected Versions: up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Vulnerability: The application suffers from improper input validation and insecure deserialization. These flaws allow an unauthenticated attacker to supply malicious input that may lead to significant system-level impacts.

Business Impact

The vulnerability carries a CVSS score of 8.2 (High), reflecting the significant risk of unauthorized system interaction. Successful exploitation could lead to full application compromise, potentially resulting in data exfiltration or unauthorized administrative control over the underlying server environment, which constitutes a severe threat to business continuity.

Remediation Plan

Immediate Action: Review the official GitHub repository for the provided fix commit (49b20f53de2b7ec34e920b11c863f1491d911a04) and update your deployment immediately.

Proactive Monitoring: Inspect server logs for unexpected serialized objects or malformed input strings directed at application entry points.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block suspicious serialized payloads before they reach the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the nature of deserialization vulnerabilities, immediate attention is required. Administrators should verify their current commit hash and apply the vendor-provided patch as soon as possible to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: liftoff-sr
PRODUCT: CIPster
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the liftoff-sr CIPster software up to commit e8e9dba09bf56962807d3504b783ccdb6287f3e4.

Executive Summary:
The liftoff-sr CIPster software contains a high-severity vulnerability in versions up to e8e9dba09bf56962807d3504b783ccdb6287f3e4, presenting a risk of unauthorized system exploitation.

Vulnerability Details

CVE-ID: CVE-2026-13592

Affected Software: liftoff-sr CIPster

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the core functionality of CIPster versions up to the specified commit. The flaw may allow an attacker to trigger unintended behavior, potentially leading to unauthorized access or service disruption.

Business Impact

The CVSS score of 7.3 classifies this as a High-severity risk. Successful exploitation could result in the compromise of the application environment, potentially leading to unauthorized data modification or administrative access, thereby impacting organizational security posture.

Remediation Plan

Immediate Action: Update the CIPster installation to the latest patched version or commit provided by the vendor.

Proactive Monitoring: Review system and application logs for irregular patterns or unauthorized execution attempts associated with the CIPster service.

Compensating Controls: Deploy network segmentation to isolate the CIPster service from public-facing networks until the vulnerability is addressed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should audit their environments to identify all instances of the affected CIPster software. Immediate application of the latest vendor-supplied patches is required to mitigate the risk of exploitation.

---METADATA---
VENDOR: Nordic Semiconductor
PRODUCT: IronSide SE for nRF54H20
AFFECTED_VERSIONS: Before version 23
---END_METADATA---

Description Summary:
Nordic Semiconductor IronSide SE for nRF54H20 versions before 23 contain an unspecified vulnerability.

Executive Summary:
A vulnerability in Nordic Semiconductor’s IronSide SE for nRF54H20 requires immediate attention and patching to ensure the security of the affected hardware platform.

Vulnerability Details

CVE-ID: CVE-2025-67841

Affected Software: Nordic Semiconductor IronSide SE for nRF54H20

Affected Versions: Before version 23

Vulnerability: This is an unspecified vulnerability affecting the IronSide SE security component for the nRF54H20 platform. The lack of detailed information necessitates a cautious approach and immediate update to the latest provided firmware or software version.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to the integrity of the nRF54H20 platform. Given that this component is often used in security-critical embedded applications, an exploit could compromise the hardware's security boundary, leading to potential data theft or device manipulation.

Remediation Plan

Immediate Action: Update the IronSide SE for nRF54H20 to version 23 or higher immediately.

Proactive Monitoring: Monitor device logs for any unusual behavior or unexpected restarts that could indicate an attempt to exploit the device.

Compensating Controls: Isolate affected devices from untrusted network segments until the firmware update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation. However, the high severity score suggests that the vulnerability may be significant and warrants prompt action.

Analyst Recommendation

Users of the nRF54H20 platform should verify their current IronSide SE version and update to version 23 or later. Ensuring the security of the embedded environment is critical for maintaining the overall integrity of the deployed solution.

Executive Summary:
A critical vulnerability has been identified in the rAthena MMORPG server software, which could allow a remote, unauthenticated attacker to take complete control of the server. This heap-based buffer overflow in the login server can be exploited to execute arbitrary code, potentially leading to server compromise, data theft, and significant service disruption. Organizations are urged to apply the recommended updates immediately to mitigate this severe risk.

Vulnerability Details

CVE-ID: CVE-2025-58447

Affected Software: rAthena is an Multiple Products

Affected Versions: All versions prior to commit 2f5248b.

Vulnerability: The vulnerability is a heap-based buffer overflow within the login server component of the rAthena software. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted packet to the login server. This action overwrites memory buffers in a way that allows the attacker to execute arbitrary code on the target server with the privileges of the server application.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high potential for widespread impact with minimal effort from an attacker. Successful exploitation could lead to a complete compromise of the game server infrastructure. Potential consequences include theft of sensitive data such as player account credentials, manipulation of the game environment, extended service downtime, and the use of the compromised server as a pivot point for further attacks against the organization's internal network.

Remediation Plan

Immediate Action: Immediately update all instances of rAthena is an Multiple Products to a version that includes commit 2f5248b or a later version. After patching, monitor for any signs of exploitation attempts by reviewing server and network access logs for unusual activity.

Proactive Monitoring: Implement enhanced monitoring of the login server. Look for anomalous network traffic patterns, malformed login packets, and unexpected crashes or restarts of the login server process. Monitor system logs for signs of unauthorized commands or processes being executed.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce the risk of exploitation:

• Place the login server behind an Intrusion Prevention System (IPS) with rules designed to detect and block buffer overflow attempts.
• Restrict access to the login server port to trusted IP ranges, if possible.
• Enhance server hardening and ensure the rAthena process runs with the lowest possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Sep 9, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the critical CVSS score and the potential for remote code execution without authentication, it is highly likely that threat actors will develop exploits in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation
Due to the critical severity (CVSS 9.8) of this vulnerability, immediate action is required. We strongly recommend that all affected rAthena servers be patched to the latest version without delay. Although this CVE is not yet on the CISA KEV list, its high impact and ease of exploitation make it a prime target for attackers. If patching is delayed, compensating controls and proactive monitoring should be implemented immediately as a temporary mitigation measure.

Executive Summary:
A high-severity vulnerability has been discovered in the Chipsalliance Rocket-Chip hardware design, which is used in multiple products. The flaw allows a potential attacker to corrupt system processes and gain elevated privileges by exploiting a weakness in how the processor handles errors. Successful exploitation could lead to a complete compromise of the affected device.

Vulnerability Details

CVE-ID: CVE-2025-56301

Affected Software: issue Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists in the Control and Status Register (CSR) logic of the Rocket-Chip core. A race condition can be triggered when a hardware exception (e.g., a page fault) occurs at the exact moment the processor is executing an MRET (Machine-mode Return from Exception) instruction. This flawed interaction corrupts the processor's internal state, specifically affecting the mechanisms that manage privilege levels and exception handling. An attacker with the ability to execute code on an affected system can craft a specific sequence of operations to trigger this condition, potentially leading to privilege escalation from a lower-privileged mode to Machine-mode, the highest privilege level.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could lead to a complete system compromise, as an attacker could escalate their privileges to the highest level. This would grant them unrestricted access to all system resources, including sensitive data, system configurations, and connected hardware. The potential business impact includes data breaches, intellectual property theft, system-wide denial of service, and the ability for an attacker to establish a persistent foothold within the infrastructure. Given that Rocket-Chip is a hardware design, this flaw could impact a wide range of embedded systems, IoT devices, and other computing platforms, making asset identification a critical first step.

Remediation Plan

Immediate Action:

• Identify all systems and devices within the environment that utilize the affected Chipsalliance Rocket-Chip core.
• Apply the security updates, firmware patches, or hardware revisions provided by the respective product vendors immediately.
• Monitor systems for any signs of exploitation attempts, paying close attention to unexpected system crashes or reboots.
• Review system and security logs for anomalous activity, particularly related to exception handling and privilege changes.

Proactive Monitoring:

• Monitor system logs for an unusual frequency of hardware exceptions, kernel panics, or unexpected trap events.
• Implement endpoint detection and response (EDR) or similar host-based monitoring to detect anomalous process behavior, such as a low-privilege process attempting to perform high-privilege actions.
• If possible, utilize hardware performance counters to monitor for abnormal sequences of MRET instructions and exceptions that could indicate an exploitation attempt.

Compensating Controls:

• If immediate patching is not feasible, restrict the execution of untrusted or third-party code on vulnerable systems.
• Employ sandboxing, virtualization, or containerization to isolate applications and limit their direct access to the underlying hardware.
• Enforce the principle of least privilege for all user accounts and system processes to limit the initial attack surface.
• Use network segmentation to isolate critical or vulnerable systems from general corporate and external networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 1, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, the flaw resides at a fundamental hardware level, making it a high-value target for advanced threat actors. The technical details in the disclosure may be sufficient for skilled security researchers to develop a proof-of-concept exploit.

Analyst Recommendation

Due to the high severity (CVSS 7.5) and the critical nature of this vulnerability, which allows for privilege escalation to the highest system level, immediate action is required. Although this vulnerability is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its potential for complete system compromise warrants urgent attention. Organizations are strongly advised to prioritize the identification of all affected assets and deploy the vendor-provided patches without delay to mitigate the risk of a security breach.

Executive Summary:
A critical vulnerability has been identified in multiple JeeWMS products, designated as CVE-2025-50901 with a CVSS score of 9.8. This flaw allows an unauthenticated attacker to bypass security controls and read arbitrary files from the underlying server, potentially exposing sensitive data such as configuration files, credentials, and proprietary information. Due to its critical severity and the ease of exploitation, immediate remediation is strongly recommended to prevent a potential data breach.

Vulnerability Details

CVE-ID: CVE-2025-50901

Affected Software: JeeWMS Multiple Products

Affected Versions: Versions including and prior to commit 771e4f5d0c01ffdeae1671be4cf102b73a3fe644. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is an incorrect authentication bypass. A flaw in the application's authentication logic allows a remote, unauthenticated attacker to circumvent access controls. By exploiting this flaw, the attacker can then leverage a file reading function, likely through path traversal, to access and exfiltrate any file on the server's filesystem that the application's user account has permission to read. This could include sensitive application source code, configuration files containing database credentials, system files, and other confidential data.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. Successful exploitation could lead to a severe data breach, resulting in the compromise of sensitive corporate data, customer information (PII), and intellectual property. The exposure of credentials read from configuration files could allow an attacker to pivot and gain deeper access to the internal network, leading to a wider system compromise. Potential consequences include significant financial loss, reputational damage, regulatory penalties, and loss of customer trust.

Remediation Plan

Immediate Action: The highest priority is to apply the security patches provided by the vendor.

• Update all instances of JeeWMS Multiple Products to the latest, patched version immediately.
• After patching, review server access logs and application logs for any signs of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring:

• Implement enhanced monitoring of web server logs for suspicious requests, such as those containing directory traversal patterns (e.g., ../, ..%2f).
• Monitor for unusual outbound network traffic from the application servers, which could indicate data exfiltration.
• Audit file system access logs for unexpected read attempts by the JeeWMS service account, particularly on sensitive system or configuration files.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with strict rules to block path traversal and other common web attack patterns.
• Restrict network access to the affected application, allowing connections only from trusted IP addresses.
• Enforce the principle of least privilege by ensuring the service account running JeeWMS has the most restrictive file permissions possible, limiting its ability to read sensitive files outside of its application directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of this advisory (Aug 20, 2025), there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the critical severity (9.8) and the nature of the flaw (unauthenticated remote file read), it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical severity of CVE-2025-50901, this vulnerability requires immediate attention. The potential for a complete compromise of sensitive data by an unauthenticated attacker makes it a top-priority target for remediation. Although it is not currently listed on the CISA KEV catalog, its high-impact nature makes it a likely candidate for future inclusion. We strongly recommend that organizations apply the vendor-supplied updates to all affected JeeWMS products without delay to mitigate this significant risk.

Executive Summary:
A critical vulnerability exists in Improper's open-source RISC-V processor implementation that could allow an attacker to bypass security constraints and gain unauthorized access to physical memory.

Vulnerability Details

CVE-ID: CVE-2025-45006

Affected Software: Improper Multiple Products

Affected Versions: See vendor advisory for specific affected products and versions.

Vulnerability: The vulnerability is due to improper retention of the mstatus.SUM bit in the processor's state, which violates privileged specification constraints. This flaw can be exploited by an attacker with local access to bypass memory protection mechanisms, leading to unauthorized access to physical memory.

Business Impact

A successful exploit could result in a complete loss of confidentiality, integrity, and availability of the affected system. An attacker could read sensitive data directly from memory, modify critical system components, or execute arbitrary code with elevated privileges. The assigned CVSS score of 9.1 (Critical) reflects the low attack complexity and the severe impact of a successful exploit, which could grant an attacker fundamental control over the hardware.

Remediation Plan

Immediate Action: Apply the necessary firmware or software updates provided by the vendor to patch the affected RISC-V processor implementation immediately.

Proactive Monitoring: Monitor systems for signs of privilege escalation or anomalous memory access patterns. Review system logs for any indicators of compromise related to this vulnerability.

Compensating Controls: Implement strict access controls and the principle of least privilege for all user and system accounts to limit the attack surface for local exploitation attempts.

Exploitation Status

Public Exploit Available: Not Publicly Known

Analyst Notes: As of Jul 1, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the fundamental nature of this hardware-level flaw, the potential for exploitation by sophisticated actors is high.

Analyst Recommendation

Given the critical severity of this vulnerability and its potential for complete system compromise, immediate action is required. Administrators of systems utilizing the affected Improper RISC-V processors must prioritize the deployment of vendor-supplied patches to mitigate the significant risk of unauthorized physical memory access and privilege escalation.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the vendor 'was', specifically impacting the Hotel-Management-System software. If exploited, this flaw could allow an attacker to access or manipulate sensitive data, potentially leading to a breach of confidential guest information and disruption of business operations. Organizations are urged to apply the vendor-provided security updates immediately to mitigate this significant risk.

Vulnerability Details

CVE-ID: CVE-2025-14207

Affected Software: was Multiple Products

Affected Versions: All versions of tushar-2223 Hotel-Management-System up to and including commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15.

Vulnerability: The vulnerability exists within the application's data handling functions. An attacker can send a specially crafted request to the system's web interface to bypass authentication or authorization checks. This could allow an unauthenticated remote attacker to execute arbitrary queries on the backend database, leading to the unauthorized disclosure, modification, or deletion of sensitive information, such as guest personal identifiable information (PII), booking details, and payment data.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.3, posing a significant risk to the organization. Successful exploitation could result in a major data breach, exposing sensitive customer information and leading to severe reputational damage, loss of customer trust, and potential financial liabilities from regulatory fines (e.g., GDPR, CCPA). Furthermore, the manipulation of booking data could disrupt hotel operations, impacting revenue and customer service. The compromise of this system could also serve as an entry point for further attacks on the corporate network.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by the vendor immediately to all affected systems. After patching, it is crucial to verify that the update has been successfully installed. Concurrently, security teams should actively monitor for any signs of exploitation attempts and conduct a thorough review of application and database access logs for any anomalous activity preceding the patch.

Proactive Monitoring: Implement enhanced monitoring of web server and database logs. Look for suspicious activity such as malformed URL requests, unexpected SQL syntax in log entries, an unusual volume of database queries from the application server, or access attempts from unknown IP addresses. Network traffic should be monitored for data exfiltration patterns or connections to command-and-control infrastructure.

Compensating Controls: If immediate patching is not feasible, organizations should implement compensating controls as a temporary measure. Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection or similar application-layer attacks. Restrict network access to the affected application to only trusted IP ranges and enforce the principle of least privilege for all database user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 8, 2025, there are no known public exploits or proof-of-concept code available for this vulnerability. Threat intelligence indicates no active exploitation in the wild at this time. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high-severity rating (CVSS 7.3) and the critical nature of the data managed by the Hotel-Management-System, we strongly recommend that organizations prioritize the immediate patching of this vulnerability. The potential for a breach of sensitive guest PII presents a substantial business risk. While there is no current evidence of active exploitation, vulnerabilities of this type are attractive targets for threat actors. Proactive remediation is the most effective strategy to prevent future compromise.

Executive Summary:
A high-severity vulnerability has been identified in the Abdullah-Hasan-Sajjad Online-School software. This flaw could allow a low-privileged attacker to access or manipulate sensitive database information, potentially leading to data breaches and unauthorized system access. Organizations are urged to apply the vendor-provided security updates immediately to mitigate the risk of exploitation.

Vulnerability Details

CVE-ID: CVE-2025-12277

Affected Software: Abdullah-Hasan-Sajjad Online-School

Affected Versions: All versions up to and including commit f09dda77b4c29aa083ff57f4b1eb991b98b68883

Vulnerability: The vulnerability is an authenticated SQL injection flaw within the application. An attacker with a low-level user account can inject malicious SQL queries through specific input fields that are not properly sanitized. Successful exploitation allows the attacker to bypass access controls and execute arbitrary commands on the backend database, enabling them to read, modify, or delete sensitive data, including user credentials, personal information, and course materials.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.3, posing a significant risk to the organization. Exploitation could lead to the compromise of sensitive student and faculty data, resulting in a major data breach. The potential consequences include reputational damage, loss of user trust, and non-compliance with data protection regulations (e.g., GDPR, FERPA). Unauthorized modification of data could also disrupt educational operations and compromise the integrity of academic records.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. The software vendor has released a patch that addresses this vulnerability, and all instances of the Abdullah-Hasan-Sajjad Online-School software should be updated to a version subsequent to the affected commit. After patching, review application and database access logs for any signs of compromise or attempted exploitation that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for indicators of compromise. This includes reviewing web server access logs for suspicious requests containing SQL syntax (e.g., UNION, SELECT, --, ' OR '1'='1') in URL parameters or POST bodies. Database logs should be monitored for unusual or malformed queries originating from the application's service account.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rulesets designed to detect and block SQL injection attacks. Additionally, enforce the principle of least privilege for the database account used by the application to limit the potential impact of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 27, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the nature of the flaw, security researchers and threat actors are likely to develop exploits following this public disclosure.

Analyst Recommendation

Due to the High severity rating of this vulnerability, immediate remediation is strongly recommended. Organizations should prioritize patching all affected systems within their established timelines for high-risk vulnerabilities. Although this CVE is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its potential for data exfiltration and system compromise makes it an attractive target for future attacks. Proactive patching is the most effective strategy to prevent potential exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple "was" products utilizing the Inferno Online Clothing Store component. This flaw could allow a remote, unauthenticated attacker to interact with the application's backend database, potentially leading to unauthorized access, modification, or deletion of sensitive data. Due to the low complexity of a potential attack, immediate remediation is critical to prevent data breaches and service disruption.

Vulnerability Details

CVE-ID: CVE-2025-11654

Affected Software: was Multiple Products

Affected Versions: All versions of the yousaf530 Inferno Online Clothing Store component up to and including commit 827dd42bfbe380e8de76fdc67958c24cf1246208.

Vulnerability: The vulnerability is an unauthenticated SQL injection flaw within the product search functionality of the Inferno Online Clothing Store application. The application fails to properly sanitize user-supplied input before using it to construct a database query. A remote attacker can craft a malicious search query containing specific SQL commands, which will then be executed by the backend database. Successful exploitation allows an attacker to bypass security controls to read, modify, or delete data from the database, including customer information, order history, and product details.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.3. Exploitation could have a significant negative impact on the business. An attacker could exfiltrate sensitive customer data (personally identifiable information, payment details), leading to regulatory fines under data protection laws like GDPR and CCPA. Furthermore, an attacker could manipulate application data, causing financial loss (e.g., changing prices) or disrupt business operations by deleting critical information, resulting in reputational damage and loss of customer trust.

Remediation Plan

Immediate Action: Identify all systems running the affected software component and apply the security updates provided by the vendor immediately. After patching, it is crucial to monitor systems for any signs of attempted or successful exploitation by reviewing web server and database access logs for anomalies that occurred prior to the patch.

Proactive Monitoring: Security teams should actively monitor for indicators of compromise. This includes inspecting web server logs for suspicious requests containing SQL syntax (e.g., ', --, UNION, SELECT) directed at application endpoints. Implement and monitor Web Application Firewall (WAF) alerts for SQL injection signatures. Database logs should be reviewed for unusual or long-running queries originating from the web application server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with strict rules designed to block SQL injection attempts against the vulnerable application components. Restrict network access to the affected applications to trusted sources only, if possible. Enhance database monitoring to detect and alert on unauthorized data access or modification patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This vulnerability was publicly disclosed on October 13, 2025. As of this date, there is no known public proof-of-concept exploit code available, and there are no reports of this vulnerability being actively exploited in the wild. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, due to the nature of SQL injection flaws, exploits can be developed quickly by threat actors.

Analyst Recommendation

Given the High severity rating (CVSS 7.3) and the fact that this vulnerability can be exploited by an unauthenticated attacker over the network, we recommend that organizations treat this as a critical priority. Although it is not yet on the CISA KEV list or being actively exploited, the risk of exploitation is significant. All affected systems should be identified and patched immediately to mitigate the risk of a potential data breach or service disruption.

Executive Summary:
A critical vulnerability has been identified in JM-DATA ONU devices, specifically version 1.0.67 of the JF511-TV model. The device uses static, default credentials which, if unchanged, allow unauthenticated attackers to gain full administrative control, posing a severe risk of network compromise, data interception, and service disruption.

Vulnerability Details

CVE-ID: CVE-2022-50803

Affected Software: JM-DATA ONU JF511-TV (and potentially other products)

Affected Versions: version 1.0.67

Vulnerability: The vulnerability exists due to the use of hardcoded, default credentials for administrative access. An attacker with network access to the device's management interface can use these publicly known credentials to log in with the highest level of privileges. This allows the attacker to view or modify all device configurations, monitor network traffic passing through the device, disable services, or use the compromised device as a pivot point to launch further attacks against the internal network.

Business Impact

This vulnerability is rated as critical, with a CVSS score of 9.8, reflecting the extreme ease of exploitation and the potential for complete system compromise. Successful exploitation could lead to significant business disruption, including loss of internet connectivity, unauthorized access to sensitive internal network resources, and data exfiltration. An attacker could manipulate network traffic, conduct man-in-the-middle attacks, or install persistent backdoors, severely impacting the confidentiality, integrity, and availability of business operations and data.

Remediation Plan

Immediate Action: The primary remediation step is to immediately change the default administrative password on all affected JM-DATA ONU devices. If a vendor-supplied firmware update is available to address this issue, it should be applied as soon as possible. Organizations should also review access logs for any signs of unauthorized logins using the default credentials.

Proactive Monitoring: Implement continuous monitoring of network device logs, specifically looking for successful or repeated failed login attempts to management interfaces from untrusted IP addresses. Monitor for unexpected configuration changes, unusual outbound traffic originating from the ONU device, or alterations to DNS settings, as these can be indicators of compromise.

Compensating Controls: If patching or changing credentials is not immediately feasible, restrict network access to the device's management interface (e.g., web portal, SSH, Telnet) to a limited set of trusted administrative IP addresses. Employ network segmentation to isolate the ONU device from critical internal network segments, limiting the potential impact of a compromise.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Dec 30, 2025, the "exploit" for this vulnerability is the public knowledge of the default credentials. This makes exploitation trivial for any attacker who can access the device's login interface. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, vulnerabilities involving default credentials are a common target for automated scanning and opportunistic attacks.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the trivial nature of exploitation, we strongly recommend that organizations take immediate action. All affected JM-DATA ONU devices must be identified and their default credentials must be changed without delay. Even though this vulnerability is not on the CISA KEV list, its high severity presents a clear and present danger to the network, and remediation should be treated as a top priority.