Monthly
DNS cache poisoning in Amazon FreeRTOS-Plus-TCP prior to V4.4.2 lets unauthenticated remote attackers insert an attacker-chosen address into a device's DNS cache by supplying a forged DNS reply that the resolver accepts before the legitimate response arrives. The flaw is an integrity-only weakness (CWE-940, improper verification of the source of a communication channel): the resolver does not adequately validate that a reply actually originated from the DNS server it queried, so a successful injection diverts subsequent outbound connections to attacker-controlled endpoints. Exploitation is constrained by high attack complexity - the attacker must match or guess reply-matching attributes such as source address/port and transaction ID and win a timing race - which favors on-path or local-network attackers over arbitrary internet senders; no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, and the vendor has released a fixed version with a required configuration flag.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Improper verification of the source of ADS discovery responses in Apache PLC4X (CWE-940) allows an attacker on the adjacent network to redirect subsequent connections to an arbitrary host by spoofing a UDP discovery response, potentially exposing ADS route credentials. Affected versions are PLC4Go 0.11.0-<1.0.0, PLC4J ADS/Modbus 0.10.0-<1.0.0, and PLC4J EtherNet/IP 0.11.0-<1.0.0. Exploitation requires the consuming application to invoke the opt-in discovery API and act on discovered items; no public exploit identified at time of analysis. Upgrade to 1.0.0 to fix.
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. No public exploit has been identified at time of analysis, but the zero-complexity adjacent-network attack makes exploitation trivially feasible by any insider - including students - on the same LAN.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Silent configuration hijack in Traccar Client GPS tracking app (versions 9.7.19 and below) allows remote attackers to redirect victim telemetry to attacker-controlled servers via a single crafted org.traccar.client://config deep link. The app accepts deep-link parameters (server URL, device ID, accuracy, distance, interval) and writes them to persistent configuration with no user confirmation, enabling continuous covert location tracking. No public exploit identified at time of analysis, but the upstream commit confirms a confirmation dialog was added in 9.7.20 as the fix.
Traffic amplification in Netty's QUIC codec (io.netty:netty-codec-classes-quic versions 4.2.0.Final through 4.2.14.Final) allows remote unauthenticated attackers to weaponize Netty-based QUIC servers as DDoS reflectors. The default NoQuicTokenHandler's validateToken() unconditionally returns 0, which the server misinterprets as a successfully Retry-validated client address, bypassing RFC 9000's 3× anti-amplification limit and causing the server to reflect full-size handshake flights (including certificates) toward a spoofed victim IP. No public exploit identified at time of analysis, but the fix is published in Netty 4.2.15.Final.
TCP packet injection vulnerability in Anviz CrossChex Standard allows adjacent network attackers to manipulate or disrupt client/server communications without authentication. The application fails to verify the source of TCP packets, enabling attackers on the same network segment to inject malicious traffic and alter application behavior or cause denial of service. CISA ICS-CERT reported this affecting physical access control and time attendance systems. EPSS data not available; no confirmed active exploitation or public exploit code identified at time of analysis.
DNS cache poisoning in Amazon FreeRTOS-Plus-TCP prior to V4.4.2 lets unauthenticated remote attackers insert an attacker-chosen address into a device's DNS cache by supplying a forged DNS reply that the resolver accepts before the legitimate response arrives. The flaw is an integrity-only weakness (CWE-940, improper verification of the source of a communication channel): the resolver does not adequately validate that a reply actually originated from the DNS server it queried, so a successful injection diverts subsequent outbound connections to attacker-controlled endpoints. Exploitation is constrained by high attack complexity - the attacker must match or guess reply-matching attributes such as source address/port and transaction ID and win a timing race - which favors on-path or local-network attackers over arbitrary internet senders; no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, and the vendor has released a fixed version with a required configuration flag.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Improper verification of the source of ADS discovery responses in Apache PLC4X (CWE-940) allows an attacker on the adjacent network to redirect subsequent connections to an arbitrary host by spoofing a UDP discovery response, potentially exposing ADS route credentials. Affected versions are PLC4Go 0.11.0-<1.0.0, PLC4J ADS/Modbus 0.10.0-<1.0.0, and PLC4J EtherNet/IP 0.11.0-<1.0.0. Exploitation requires the consuming application to invoke the opt-in discovery API and act on discovered items; no public exploit identified at time of analysis. Upgrade to 1.0.0 to fix.
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. No public exploit has been identified at time of analysis, but the zero-complexity adjacent-network attack makes exploitation trivially feasible by any insider - including students - on the same LAN.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Silent configuration hijack in Traccar Client GPS tracking app (versions 9.7.19 and below) allows remote attackers to redirect victim telemetry to attacker-controlled servers via a single crafted org.traccar.client://config deep link. The app accepts deep-link parameters (server URL, device ID, accuracy, distance, interval) and writes them to persistent configuration with no user confirmation, enabling continuous covert location tracking. No public exploit identified at time of analysis, but the upstream commit confirms a confirmation dialog was added in 9.7.20 as the fix.
Traffic amplification in Netty's QUIC codec (io.netty:netty-codec-classes-quic versions 4.2.0.Final through 4.2.14.Final) allows remote unauthenticated attackers to weaponize Netty-based QUIC servers as DDoS reflectors. The default NoQuicTokenHandler's validateToken() unconditionally returns 0, which the server misinterprets as a successfully Retry-validated client address, bypassing RFC 9000's 3× anti-amplification limit and causing the server to reflect full-size handshake flights (including certificates) toward a spoofed victim IP. No public exploit identified at time of analysis, but the fix is published in Netty 4.2.15.Final.
TCP packet injection vulnerability in Anviz CrossChex Standard allows adjacent network attackers to manipulate or disrupt client/server communications without authentication. The application fails to verify the source of TCP packets, enabling attackers on the same network segment to inject malicious traffic and alter application behavior or cause denial of service. CISA ICS-CERT reported this affecting physical access control and time attendance systems. EPSS data not available; no confirmed active exploitation or public exploit code identified at time of analysis.