Nicmx
Monthly
Cross-origin RRDP URL confusion in FORT Validator through 1.6.7 allows a delegated Certificate Authority sharing the same Trust Anchor Locator to silently poison the validator's download cache, causing the victim CA's Validated ROA Payloads and signed objects to be purged from FORT's routing origin validation output. The resulting VRP gaps - triggered passively by the victim's own routine publication cycle - can enable BGP route hijacking or loss of network reachability for the affected IP prefixes. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity impact on subsequent routing infrastructure reflects serious operational risk for networks relying on FORT for RPKI-based origin validation.
An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-origin RRDP URL confusion in FORT Validator through 1.6.7 allows a delegated Certificate Authority sharing the same Trust Anchor Locator to silently poison the validator's download cache, causing the victim CA's Validated ROA Payloads and signed objects to be purged from FORT's routing origin validation output. The resulting VRP gaps - triggered passively by the victim's own routine publication cycle - can enable BGP route hijacking or loss of network reachability for the affected IP prefixes. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity impact on subsequent routing infrastructure reflects serious operational risk for networks relying on FORT for RPKI-based origin validation.
An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Fort before 1.6.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.