Monthly
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker who already holds a low-privilege foothold on a Windows host to leverage an externally-controlled format string and reach full SYSTEM-level code execution. Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the only meaningful barrier is the local, authenticated prerequisite: it is not remotely reachable and requires no user interaction. Our independent assessment rates this a credible but not top-tier priority, and no public exploit code has been identified at time of analysis; the vendor has released a patch.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Unauthenticated remote code execution is the exposure created by a format string flaw in a service interface of HPE Networking ClearPass Policy Manager: an attacker who can reach the vulnerable interface can supply crafted input that corrupts process memory and, on successful exploitation, execute arbitrary code in the context of the affected service, with high confidentiality, integrity and availability impact (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation is identified at the time of analysis, and the report originates from HPE's own security-alert address, but the absence of authentication, user interaction or attack complexity means exploitation is straightforward for any attacker with network reachability to the interface. The practical limiting factor is exposure: ClearPass management and service interfaces are normally confined to segmented management networks, so internet-facing or user-network-reachable deployments carry the greatest immediate risk.
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file through the web-based management interface that is subsequently processed with an attacker-influenced format string by a vulnerable router module (CWE-134). The vendor's CVSS 4.0 score of 9.4 (Critical) reflects complete loss of confidentiality, integrity, and availability on the vulnerable component plus a scope change, but exploitation is gated by a pre-existing high-privilege administrator session per the PR:H vector metric, so exposure depends on whether the management interface is reachable by the attacker (WAN-exposed remote administration versus LAN-only) and on the strength of admin credentials. No public exploit code and no confirmed active exploitation have been identified at time of analysis, no EPSS score was supplied, and the wildcard CPE (cpe:2.3:a:asus:router:*:*:*:*:*:*:*:*) means specific affected models and firmware builds are not enumerated in the available data.
Local privilege escalation in the NVIDIA GPU Display Driver for Linux lets an already-authenticated, low-privileged user trigger a format string defect (CWE-134) and potentially achieve code execution, privilege escalation, data tampering, denial of service, and information disclosure; NVIDIA rates it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack surface is strictly local - there is no remote vector - so real risk concentrates on multi-user and multi-tenant GPU systems such as HPC clusters, ML/AI training nodes, shared engineering workstations, and cloud GPU instances, where a low-privileged tenant could reach the driver while other users' data and the host remain in scope. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the impact rating of total confidentiality, integrity, and availability loss is consistent with memory corruption inside a privileged driver context.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker who already holds a low-privilege foothold on a Windows host to leverage an externally-controlled format string and reach full SYSTEM-level code execution. Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the only meaningful barrier is the local, authenticated prerequisite: it is not remotely reachable and requires no user interaction. Our independent assessment rates this a credible but not top-tier priority, and no public exploit code has been identified at time of analysis; the vendor has released a patch.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Unauthenticated remote code execution is the exposure created by a format string flaw in a service interface of HPE Networking ClearPass Policy Manager: an attacker who can reach the vulnerable interface can supply crafted input that corrupts process memory and, on successful exploitation, execute arbitrary code in the context of the affected service, with high confidentiality, integrity and availability impact (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation is identified at the time of analysis, and the report originates from HPE's own security-alert address, but the absence of authentication, user interaction or attack complexity means exploitation is straightforward for any attacker with network reachability to the interface. The practical limiting factor is exposure: ClearPass management and service interfaces are normally confined to segmented management networks, so internet-facing or user-network-reachable deployments carry the greatest immediate risk.
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file through the web-based management interface that is subsequently processed with an attacker-influenced format string by a vulnerable router module (CWE-134). The vendor's CVSS 4.0 score of 9.4 (Critical) reflects complete loss of confidentiality, integrity, and availability on the vulnerable component plus a scope change, but exploitation is gated by a pre-existing high-privilege administrator session per the PR:H vector metric, so exposure depends on whether the management interface is reachable by the attacker (WAN-exposed remote administration versus LAN-only) and on the strength of admin credentials. No public exploit code and no confirmed active exploitation have been identified at time of analysis, no EPSS score was supplied, and the wildcard CPE (cpe:2.3:a:asus:router:*:*:*:*:*:*:*:*) means specific affected models and firmware builds are not enumerated in the available data.
Local privilege escalation in the NVIDIA GPU Display Driver for Linux lets an already-authenticated, low-privileged user trigger a format string defect (CWE-134) and potentially achieve code execution, privilege escalation, data tampering, denial of service, and information disclosure; NVIDIA rates it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack surface is strictly local - there is no remote vector - so real risk concentrates on multi-user and multi-tenant GPU systems such as HPC clusters, ML/AI training nodes, shared engineering workstations, and cloud GPU instances, where a low-privileged tenant could reach the driver while other users' data and the host remain in scope. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the impact rating of total confidentiality, integrity, and availability loss is consistent with memory corruption inside a privileged driver context.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.