CVE-2025-26326
HighSummary
Zidentyfikowano podatność w dodatkach do zdalnego połączenia NVDA Remote (wersja 2.6.4) oraz Tele NVDA Remote (wersja 2025.3.3), która pozwala atakującemu na uzyskanie pełnej kontroli nad zdalnym systemem poprzez odgadnięcie słabego hasła. Dodatki te akceptują każde hasło wprowadzone przez użytkownika, nie posiadając dodatkowego mechanizmu uwierzytelniania ani weryfikacji komputera.
Risk Assessment
Ryzyko dla organizacji polega na tym, że atakujący może uzyskać pełny dostęp do systemu, co pozwala na wykonywanie poleceń, modyfikację plików oraz naruszenie bezpieczeństwa użytkowników. Wiele systemów korzysta z łatwych do odgadnięcia haseł, co zwiększa podatność na ataki brute force.
Recommendation
Zaleca się wprowadzenie silnych haseł oraz dodatkowych mechanizmów uwierzytelniania dla zdalnych połączeń. Należy również przeprowadzić audyt haseł w używanych systemach i wymusić zmianę słabych haseł na silniejsze.
Related vulnerabilities
- CVE-2026-94053Critical
Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".
- CVE-2026-94052Critical
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.
- CVE-2026-77185Critical
Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.
- CVE-2026-102458Critical
Missing Authentication vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- CVE-2026-102455Critical
Insecure Deserialization vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-103110Critical
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
- CVE-2026-102911Critical
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to OS command injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-103056Critical
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Original NVD description (English source)
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS