CVE-2026-44943
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A Path Traversal vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.
Risk Assessment
An attacker can gain unauthorized access to the filesystem, create files with root privileges, and modify data, potentially leading to privilege escalation or system integrity compromise.
Recommendation
Update open-iscsi to a patched version or apply proper path restrictions to prevent access outside the allowed directory.
Other vulnerabilities in open-iscsi
See all- CVE-2017-17840High
An issue was discovered in Open-iSCSI through 2.0.875 that allows a local attacker to cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths. The lack of payload length validation in the process_iscsid_broadcast function leads to buffer overflows.
- CVE-2026-18728Medium
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 DHCP parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing.
- CVE-2026-18727Medium
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during DHCPv6 packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short UDP length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
- CVE-2026-18726Medium
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted ICMPv6 Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
- CVE-2026-55995High
open-iscsi has a Double Free vulnerability that allows an unauthenticated MITM attacker to cause DoS. The issue affects versions up to 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.
- CVE-2026-44944High
open-iscsi has an Incorrect Authorization vulnerability that allows unprivileged local users to use the iscsiuio control socket. The issue affects versions up to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
Original NVD description (English source)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.