CVE-2026-2181
published 2026-02-08CVE-2026-2181: A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi…
PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.66%
51.2th percentile
A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | rx3 | — | — |
| tenda | rx3_firmware | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hcmw-7h84-qr3x: A security flaw has been discovered in Tenda RX3 16
ghsa_unreviewed·2026-02-08
CVE-2026-2181 [HIGH] CWE-119 GHSA-hcmw-7h84-qr3x: A security flaw has been discovered in Tenda RX3 16
A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Red Hat
zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
vendor_redhat·2026-09-16·CVSS 7.5
CVE-2026-79993 [HIGH] CWE-425 zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DE
Red Hat
sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
vendor_redhat·2026-08-19·CVSS 9.3
CVE-2026-47187 [CRITICAL] CWE-59 sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files bac
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [fedora-all]
bugzilla·2026-09-28·CVSS 9.3
CVE-2026-47187 [CRITICAL] CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [fedora-all]
CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at ss
Bugzilla
CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [epel-all]
bugzilla·2026-09-28·CVSS 9.3
CVE-2026-47187 [CRITICAL] CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [epel-all]
CVE-2026-47187 fuse-sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshf
Bugzilla
CVE-2026-79993 zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
bugzilla·2026-09-16·CVSS 7.5
CVE-2026-79993 [HIGH] CVE-2026-79993 zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
CVE-2026-79993 zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session c
Bugzilla
CVE-2026-47187 sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
bugzilla·2026-08-19·CVSS 9.3
CVE-2026-47187 [CRITICAL] CVE-2026-47187 sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
CVE-2026-47187 sshfs: SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable
2026-02-08
Published