CVE-2026-76524: CVE-2026-76524: kritik işlevde kimlik doğrulaması eksik

Açıklama (NVD)

A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.

Özet bilgiler

CVSS v3.1

7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,18 (yüzdelik 7)

CWE

CWE-306

Yama

Yok / bilinmiyor

İlgili haberler

• Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
• Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability

Kaynaklar

• NVD kaydı
• sec.cloudapps.cisco.com
• CWE-306