[0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:42 UTC
Importiert: 2026-10-15 09:17 UTC
Quelle-ID: full_disc
uid_hash: c1ec9d82b13057da6ddfc74b1ae6604ae3ba606ba90dca9becf332a985283791

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald

COMmander 6000 and COMmander 6000R, firmware 8.6D build 128154, the

closed-source enterprise IP-PBX and unified-communications appliances from

Auerswald (Germany). Two unauthenticated HTTP requests, carrying no cookie and

no credential of any kind, yield uid=0(root) gid=0(root) groups=0(root) on an

appliance that holds extension credentials, SIP trunk credentials, call...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss