Veille CVE

Semaine du 7 septembre au 13 septembre 2026

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-86060 9.8 Critique Exploitée

    Mikrotik RouterOS

    RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

  2. CVE-2025-67038 9.8 Critique Exploitée

    Lantronix EDS5000 series · Lantronix G520 series · Lantronix X300 series · Lantronix E210 series

    An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.