rootpwn

critical · CVSS v3 9.8 · CVSS v4 6.8

CVE-2026-78249

A path traversal flaw in the web management interface of certain Apeos multifunction devices allows attackers to access arbitrary files. The

Overview

A path traversal flaw in the web management interface of certain Apeos multifunction devices allows attackers to access arbitrary files. The vulnerability can be exploited by sending a crafted request to the device's web server.

Description

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a specially crafted, malicious request, it may trigger unintended processing.

Impact

Confidentiality: attackers could read sensitive configuration files. Integrity: malicious files could be uploaded or modified. Availability: repeated exploitation may degrade device performance. Device administrators and network operators are directly impacted.

Remediation

Apply the vendor-issued firmware patch that fixes the path-traversal logic. If a patch is unavailable, disable the web management interface or restrict it to trusted IPs via firewall rules. Ensure the device is updated to the latest firmware version.

Risk context

The CVSS v3 score of 9.8 marks this as a critical vulnerability with high exploitation potential. No EPSS data is available, but the severity warrants immediate attention.

Affected products

  • Apeos C4571
  • Apeos C3567
  • Multifunction Devices and Printers

Scores

Severity
critical
CVSS v2
5
CVSS v3
9.8
CVSS v4
6.8
EPSS
—

path-traversal web-interface multifunction-device printer critical CVE-2026-78249

← All CVEs

Related CVEs

critical

CVE-2026-15989

The Super Forms - Drag & Drop Form Builder plugin for WordPress has an unauthenticated privilege escalation flaw in the Register & Login add-on. It can allow new user registration to be created with an elevated role because the submitted role value is not validated against the configured registration role. This matters because an attacker can gain administrator-level control of affected WordPress sites.

View analysis

critical

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.

View analysis

critical

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in crlserver that can be triggered when adding CRL URLs. An authenticated user with permission to manage CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl CLI may cause shell command substitution to be processed as root on the BoKS Master. This matters because network-accessible administration paths can lead to full compromise of the BoKS Master.

View analysis

critical

CVE-2026-79901

CVE-2026-79901 affects BoKS keytab management deployments where boks_keytabmd generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. The weakness allows an attacker who knows the service principal and can approximate the password-change time to derive a limited candidate set and test it offline. It matters because compromised service-account credentials can enable unauthorized access to Kerberos-protected resources.

View analysis