CVE-2026-4748
HighSummary
W wyniku regresji w sposobie obliczania hashy, reguły zawierające składnię zakresu adresów (x.x.x.x - y.y.y.y) różniące się jedynie zakresem adresów są cicho ignorowane jako duplikaty. Tylko pierwsza z takich reguł jest ładowana do pf, co może prowadzić do nieoczekiwanego zachowania.
Risk Assessment
Ignorowanie dotkniętych reguł może prowadzić do nieprawidłowego blokowania lub nadmiernego odblokowywania ruchu, co stwarza ryzyko dla bezpieczeństwa sieci organizacji.
Recommendation
Zaleca się przegląd i aktualizację reguł zapory, aby upewnić się, że nie są one ignorowane oraz monitorowanie zachowania systemu w celu wykrycia potencjalnych problemów.
Related vulnerabilities
- CVE-2026-90680Critical
A stack-based buffer overflow vulnerability was discovered in D-Link DIR-823G version 1.0.2B05_20181207, in the strcpy function of /HNAP1/SetStaticRouteSettings (HNAP1 component). Manipulating the PAddress/SubnetMask/Gateway arguments triggers the overflow. The attack can be launched remotely.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-90607Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.
- CVE-2026-90606Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formIpv6Setup function of /boafrm/formIpv6Setup (boa component). Manipulating the static_ipv6 argument leads to the overflow. The attack is possible remotely and the exploit has been disclosed publicly.
- CVE-2026-90605Critical
A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.
- CVE-2026-81648Critical
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
- CVE-2026-90558Critical
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
- CVE-2026-78159Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.
- CVE-2026-78006Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.
- CVE-2026-85681Critical
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Original NVD description (English source)
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.