CVE-2026-33923
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges when installed.
Risk Assessment
An attacker with administrative privileges can read or modify sensitive data, change the appliance configuration, or shut down the appliance. Exploitation requires valid administrative access.
Recommendation
Apply the vendor patch for the update installation functionality. Restrict administrative access to the appliance and verify the integrity of update bundles.
Other vulnerabilities in Update installation functionality
Original NVD description (English source)
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS