CVE-2025-70083
HighSummary
W OpenSatKit w wersji 2.2.1 odkryto problem związany z polem DirName w telekomendzie, które jest dostarczane przez segment naziemny i powinno być traktowane jako niezaufane dane wejściowe. Program kopiuje DirName do lokalnego bufora DirWithSep za pomocą funkcji strcpy, co prowadzi do przepełnienia bufora stosu, jeśli długość DirName jest większa lub równa OS_MAX_PATH_LEN.
Risk Assessment
Przepełnienie bufora stosu może prowadzić do nadpisania sąsiedniej pamięci stosu, co stwarza poważne ryzyko dla integralności i bezpieczeństwa systemu. Atakujący może wykorzystać tę podatność do wykonania złośliwego kodu lub destabilizacji systemu.
Recommendation
Zaleca się wprowadzenie walidacji długości DirName przed operacją strcpy, aby zapobiec przepełnieniu bufora. Należy również rozważyć użycie bezpieczniejszych funkcji kopiowania, które ograniczają długość kopiowanych danych.
Related vulnerabilities
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13639Critical
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-67101Critical
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
- CVE-2026-67100Critical
HCL BigFix Service Management is affected by SQL Injection and Cross-Tenant Data Exposure vulnerabilities, which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.
- CVE-2026-93467Critical
The OAKlouds developed by HGiga has an Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-85878Critical
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69843Critical
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-62874Critical
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.