CVE-2026-15461
MediumCVSS 5.3Summary
The Sierra Wireless HL78xx modem GNSS driver contains a type confusion bug — the gnss_nmea0183_match_data struct is not the first member of hl78xx_gnss_data, so the NMEA parser callbacks (GGA/RMC/GSV) read and write data at a shifted offset. As a result, the GSV callback performs a write through an uninitialized pointer with a garbage bound, potentially causing a kernel crash (DoS) and, on MMU-less targets, adjacent-memory corruption.
Risk Assessment
The vulnerability can be triggered by a party able to influence the GNSS signal (e.g., radio-proximity GNSS spoofing), causing a kernel crash and denial of service. Confidentiality is not affected, and exploitation requires the satellites feature to be enabled and active, making attack complexity high.
Recommendation
Update the kernel to a version containing the fix for CVE-2026-15461, or disable CONFIG_GNSS_SATELLITES if not required. Until the patch is applied, consider limiting exposure of HL78xx-equipped devices to GNSS signal spoofing.
Related vulnerabilities
- CVE-2026-124059Critical
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. The function setWiFiWdsAddConfig in the file /cgi-bin/cstecgi.cgi is affected, where manipulation of the ApCliKeyStr argument leads to a buffer overflow. The attack may be initiated remotely, and the exploit has been disclosed publicly and may be used.
- CVE-2026-124058Critical
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. The function setWiFiRepeaterConfig in the file /cgi-bin/cstecgi.cgi is affected, where manipulation of the ApCliKeyStr argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-124057Critical
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Manipulation of the argument Key1Str1 results in a buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-123966Critical
A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-120984Critical
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.
- CVE-2026-122041Critical
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to and including 3.8.0 is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function. The handler is registered for both wp_ajax and wp_ajax_nopriv and gated solely by the 'file_handling_nonce' nonce, which is exposed in the public checkout page markup.
- CVE-2026-119075Critical
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in FormHandler::validate_checkout_fields() in versions up to and including 1.1.4. The checkout registration path stores the raw $_POST['user_roles'] value without validation, and add_user_data() injects it as the new account's role.
- CVE-2026-118066Critical
The LatePoint plugin for WordPress is vulnerable to authentication bypass via account takeover in versions up to and including 5.7.6. OsModel::build_conditions_query() compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates a match directly into SQL without binding, allowing unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route and overwrite the lowest-id customer's password.
- CVE-2026-104014Critical
The Naimur Email OTP Verification for WooCommerce plugin is vulnerable to authentication bypass in versions up to and including 2.1.0. The password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, session binding, or per-reset token, and the scheduled cleanup cron has no handler so it never runs.
- CVE-2026-123961Critical
A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 affecting the setWiFiBasicConfig function in /cgi-bin/cstecgi.cgi. Manipulation of the KeyStr argument leads to a buffer overflow. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data inside struct hl78xx_gnss_data. The generic NMEA0183 match helper (drivers/gnss/gnss_nmea0183_match.c) requires that context to be the first member because its callbacks cast user_data directly to struct gnss_nmea0183_match_data . In the affected releases match_data was the second member (after const struct device dev), so it sat at a non-zero offset while gnss_nmea0183_match_init() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it. When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnss_nmea0183_match_gsv_callback, active under CONFIG_GNSS_SATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xx_gnss_data — and then writes parsed struct gnss_satellite entries through that bogus pointer. This is a write through an uninitialized/wild pointer with a garbage bound. The NMEA handlers are registered by default (CONFIG_HL78XX_GNSS_SOURCE_NMEA is the default GNSS source) on devices using the HL78xx GNSS. The driver runs in kernel context and the NMEA data originates from the GNSS radio front-end, so a party able to influence the GNSS signal (for example GNSS/GPS spoofing at radio proximity) can drive the kernel-side parser into the faulty write. The most likely impact is a crash (denial of service) because the bogus pointer resolves to a fixed near-NULL value, with adjacent-memory corruption possible on MMU-less targets. Confidentiality is not affected. Exploitation requires the satellites feature to be enabled and active, so attack complexity is high.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS