Common Weakness Enumeration
CWE-506
Allowed-with-ReviewEmbedded Malicious Code
Abstraction: Class · Status: Incomplete
The product contains code that appears to be malicious in nature.
546 vulnerabilities reference this CWE, most recent first.
CVE-2026-77651 (GCVE-0-2026-77651)
Vulnerability from cvelistv5 – Published: 2026-08-21 00:41 – Updated: 2026-08-21 13:17
VLAI
EPSS
VEX
Summary
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 13:17 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T13:17:41.622051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T13:17:52.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "arrayref",
"vendor": "droundy",
"versions": [
{
"status": "affected",
"version": "0.3.10",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T00:41:36.099Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"
},
{
"url": "https://github.com/rustsec/advisory-db/issues/3161"
},
{
"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"
},
{
"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77651",
"datePublished": "2026-08-21T00:41:36.099Z",
"dateReserved": "2026-08-21T00:41:35.750Z",
"dateUpdated": "2026-08-21T13:17:52.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77650 (GCVE-0-2026-77650)
Vulnerability from cvelistv5 – Published: 2026-08-21 00:40 – Updated: 2026-08-21 13:20
VLAI
EPSS
VEX
Summary
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 13:18 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| droundy | append-only-vec |
Affected:
0.1.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T13:18:56.634996Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T13:20:06.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "append-only-vec",
"vendor": "droundy",
"versions": [
{
"status": "affected",
"version": "0.1.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T00:40:26.467Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"
},
{
"url": "https://github.com/rustsec/advisory-db/issues/3161"
},
{
"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"
},
{
"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0262.html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77650",
"datePublished": "2026-08-21T00:40:26.467Z",
"dateReserved": "2026-08-21T00:40:26.113Z",
"dateUpdated": "2026-08-21T13:20:06.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77649 (GCVE-0-2026-77649)
Vulnerability from cvelistv5 – Published: 2026-08-21 00:39 – Updated: 2026-08-21 13:25
VLAI
EPSS
VEX
Summary
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 13:25 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| droundy | internment |
Affected:
0.8.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T13:25:28.760292Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T13:25:41.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "internment",
"vendor": "droundy",
"versions": [
{
"status": "affected",
"version": "0.8.7",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T00:39:02.071Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref"
},
{
"url": "https://github.com/rustsec/advisory-db/issues/3161"
},
{
"url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"
},
{
"url": "https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0266.html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-77649",
"datePublished": "2026-08-21T00:39:02.071Z",
"dateReserved": "2026-08-21T00:39:01.558Z",
"dateUpdated": "2026-08-21T13:25:41.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73533 (GCVE-0-2026-73533)
Vulnerability from cvelistv5 – Published: 2026-08-13 16:00 – Updated: 2026-08-17 15:08 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
Summary
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:07 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://wpmanageninja.com/security-incident-on-31… | technical-description |
| https://wordpress.org/plugins/ninja-tables/ | product |
| https://www.vulncheck.com/advisories/ninja-tables… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPManageNinja | Ninja Tables Pro |
Affected:
5.2.11
(semver)
cpe:2.3:a:wpmanageninja:ninja_tables:5.2.11:*:*:*:*:wordpress:*:* |
Date Public
2026-08-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73533",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:07:55.305156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:08:31.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Ninja Tables Pro",
"vendor": "WPManageNinja",
"versions": [
{
"status": "affected",
"version": "5.2.11",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wpmanageninja:ninja_tables:5.2.11:*:*:*:*:wordpress:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:52:30.724Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WPManageNinja Security Incident",
"tags": [
"technical-description"
],
"url": "https://wpmanageninja.com/security-incident-on-31-july-2026/"
},
{
"name": "WP Plugin Page",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/ninja-tables/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ninja-tables-pro-embedded-malicious-code-via-tampered-plugin-build"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73533",
"datePublished": "2026-08-13T16:00:48.030Z",
"dateReserved": "2026-08-12T19:29:19.867Z",
"dateUpdated": "2026-08-17T15:08:31.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73532 (GCVE-0-2026-73532)
Vulnerability from cvelistv5 – Published: 2026-08-13 16:01 – Updated: 2026-08-14 16:48 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Summary
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:47 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://wpmanageninja.com/security-incident-on-31… | technical-description |
| https://wordpress.org/plugins/fluentform/ | product |
| https://patchstack.com/database/wordpress/plugin/… | third-party-advisory |
| https://www.vulncheck.com/advisories/fluent-forms… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPManageNinja | Fluent Forms Pro |
Affected:
6.2.7
(semver)
|
Date Public
2026-08-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73532",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:47:48.823900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:48:08.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Fluent Forms Pro",
"vendor": "WPManageNinja",
"versions": [
{
"status": "affected",
"version": "6.2.7",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:01:19.629Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WPManageNinja Security Incident",
"tags": [
"technical-description"
],
"url": "https://wpmanageninja.com/security-incident-on-31-july-2026/"
},
{
"name": "WP Plugin Page",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/fluentform/"
},
{
"name": "Patchstack Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://patchstack.com/database/wordpress/plugin/fluentformpro/vulnerability/wordpress-fluent-forms-pro-add-on-pack-plugin-6-2-7-6-2-7-remote-code-execution-vulnerability"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluent-forms-pro-embedded-malicious-code-via-tampered-plugin-build"
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73532",
"datePublished": "2026-08-13T16:01:19.629Z",
"dateReserved": "2026-08-12T19:29:19.866Z",
"dateUpdated": "2026-08-14T16:48:08.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67595 (GCVE-0-2026-67595)
Vulnerability from cvelistv5 – Published: 2026-07-29 21:33 – Updated: 2026-08-14 16:50 X_Open Source X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
Summary
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-30 14:21 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/webreinvent/vaahcms/pull/317 | issue-tracking |
| https://github.com/webreinvent/vaahcms/commit/8d7… | patch |
| https://www.vulncheck.com/advisories/vaahcms-mali… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webreinvent | vaahcms |
Affected:
2.0.0 , ≤ 2.3.4
(semver)
Unaffected: 8d7898f7a385a5fade1180a9b664ff158d873129 (git) cpe:2.3:a:webreinvent:vaahcms:*:*:*:*:*:*:*:* |
Date Public
2026-03-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T14:21:35.095590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:17:56.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/webreinvent/vaahcms",
"product": "vaahcms",
"repo": "https://github.com/webreinvent/vaahcms",
"vendor": "webreinvent",
"versions": [
{
"lessThanOrEqual": "2.3.4",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8d7898f7a385a5fade1180a9b664ff158d873129",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webreinvent:vaahcms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.3.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ilhomjon Rustamov"
}
],
"datePublic": "2026-03-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:50:58.023Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/webreinvent/vaahcms/pull/317"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vaahcms-malicious-javascript-supply-chain-via-security-otp-blade-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source",
"x_known-exploited-vulnerability"
],
"title": "VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67595",
"datePublished": "2026-07-29T21:33:25.952Z",
"dateReserved": "2026-07-29T21:07:39.201Z",
"dateUpdated": "2026-08-14T16:50:58.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66747 (GCVE-0-2026-66747)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20
VLAI
EPSS
VEX
Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:19 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulncheck.com/blog/zbt-endlessdoors | technical-descriptionexploit |
| https://www.zbtlink.com/pages/zbt-router-firmware… | product |
| https://github.com/ycsunjane/rctl | |
| https://www.vulncheck.com/advisories/zbt-endlessdoors | third-party-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | CPE2801 Firmware |
Affected:
22.10.09
(custom)
cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1026-5G-WD Firmware |
Affected:
21.04.07
(custom)
cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1326 Firmware |
Affected:
22.02.18_1
(custom)
cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2007 Firmware |
Affected:
23.08.12
(custom)
cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2008-DSIM Firmware |
Affected:
23.08.11
(custom)
cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2416 Firmware |
Affected:
21.03.22_1
(custom)
cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE3326 Firmware |
Affected:
20.09.30
(custom)
cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5927 Firmware |
Affected:
22.08.10
(custom)
cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931 Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931AC Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE826-T3-DSIM Firmware |
Affected:
21.12.21
(custom)
cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG108 Firmware |
Affected:
21.08.06_1
(custom)
cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG209 Firmware |
Affected:
21.07.28
(custom)
cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG259 Firmware |
Affected:
21.03.23
(custom)
cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1602 Firmware |
Affected:
23.10.11
(custom)
cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1608-DSIM Firmware |
Affected:
23.03.16
(custom)
cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2105 Firmware |
Affected:
22.05.30
(custom)
cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2107 Firmware |
Affected:
22.09.08
(custom)
cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG3526 Firmware |
Affected:
22.11.01
(custom)
cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | ZBT-Z8102AX-2SIM Firmware |
Affected:
7.6.7.2-25.0814_114432
(custom)
cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* |
Date Public
2026-08-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:19:25.533200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:20:12.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "CPE2801 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.10.09",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1026-5G-WD Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.04.07",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.02.18_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2007 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.12",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2008-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2416 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.22_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE3326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.09.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5927 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931AC Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE826-T3-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.12.21",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG108 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.08.06_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG209 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.07.28",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG259 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.23",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1602 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.10.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1608-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.03.16",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2105 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2107 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.09.08",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG3526 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.11.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"ARM"
],
"product": "ZBT-Z8102AX-2SIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "7.6.7.2-25.0814_114432",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
}
],
"value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:55:20.206Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Research Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"name": "Vendor Firmware Download Page",
"tags": [
"product"
],
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
},
{
"name": "Upstream Open Source rctl",
"url": "https://github.com/ycsunjane/rctl"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66747",
"datePublished": "2026-08-05T10:50:45.576Z",
"dateReserved": "2026-07-27T16:27:47.648Z",
"dateUpdated": "2026-08-05T14:20:12.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48161 (GCVE-0-2026-48161)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:27 – Updated: 2026-08-11 17:08
VLAI
EPSS
VEX
Title
react18-use was vulnerable to malicious code execution via compromised commits
Summary
react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-19 01:07:01 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-19 01:07:01, and clean local clones.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:07 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/dai-shi/react18-use/security/a… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dai-shi | react18-use |
Affected:
>= 7b79148d1495a2505f9277da295a98cf176f4496, <= 7b79148d1495a2505f9277da295a98cf176f4496
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:07:58.687644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:08:12.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "react18-use",
"vendor": "dai-shi",
"versions": [
{
"status": "affected",
"version": "\u003e= 7b79148d1495a2505f9277da295a98cf176f4496, \u003c= 7b79148d1495a2505f9277da295a98cf176f4496"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user\u0027s permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-19 01:07:01 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-19 01:07:01, and clean local clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:27:35.472Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dai-shi/react18-use/security/advisories/GHSA-32xh-vg5f-64fm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dai-shi/react18-use/security/advisories/GHSA-32xh-vg5f-64fm"
}
],
"source": {
"advisory": "GHSA-32xh-vg5f-64fm",
"discovery": "UNKNOWN"
},
"title": "react18-use was vulnerable to malicious code execution via compromised commits"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48161",
"datePublished": "2026-08-10T22:27:35.472Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-11T17:08:12.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48160 (GCVE-0-2026-48160)
Vulnerability from cvelistv5 – Published: 2026-08-10 21:08 – Updated: 2026-08-11 16:01
VLAI
EPSS
VEX
Title
react-tracked was vulnerable to malicious code execution via compromised commits
Summary
react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 19:26:36, and clean local clones.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 16:00 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/dai-shi/react-tracked/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dai-shi | react-tracked |
Affected:
>= 6978272a7d6ca02225cb747ea69f427512e33699, <= 949f1a3d6bb1ff7d1a0dec892afd773e742627e8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T16:00:58.673154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T16:01:31.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "react-tracked",
"vendor": "dai-shi",
"versions": [
{
"status": "affected",
"version": "\u003e= 6978272a7d6ca02225cb747ea69f427512e33699, \u003c= 949f1a3d6bb1ff7d1a0dec892afd773e742627e8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user\u0027s permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 19:26:36, and clean local clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:08:54.653Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dai-shi/react-tracked/security/advisories/GHSA-79c5-q7m9-9c6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dai-shi/react-tracked/security/advisories/GHSA-79c5-q7m9-9c6x"
}
],
"source": {
"advisory": "GHSA-79c5-q7m9-9c6x",
"discovery": "UNKNOWN"
},
"title": "react-tracked was vulnerable to malicious code execution via compromised commits"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48160",
"datePublished": "2026-08-10T21:08:54.653Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-11T16:01:31.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48159 (GCVE-0-2026-48159)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:55 – Updated: 2026-08-11 02:04
VLAI
EPSS
VEX
Title
use-reducer-async was vulnerable to malicious code execution via compromised commits
Summary
use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 16:29:52 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-18 16:29:52, and clean local clones.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 02:03 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/dai-shi/use-reducer-async/secu… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dai-shi | use-reducer-async |
Affected:
>= da72edbde5705efcec6c62e0a3dcb73687b78dc8, <= df07d5711458d8b46e11dd7afaaa21e88cafabfb
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T02:03:03.295661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T02:04:18.667Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "use-reducer-async",
"vendor": "dai-shi",
"versions": [
{
"status": "affected",
"version": "\u003e= da72edbde5705efcec6c62e0a3dcb73687b78dc8, \u003c= df07d5711458d8b46e11dd7afaaa21e88cafabfb"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user\u0027s permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 16:29:52 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-18 16:29:52, and clean local clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:45.932Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dai-shi/use-reducer-async/security/advisories/GHSA-2786-p4vj-vx8x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dai-shi/use-reducer-async/security/advisories/GHSA-2786-p4vj-vx8x"
}
],
"source": {
"advisory": "GHSA-2786-p4vj-vx8x",
"discovery": "UNKNOWN"
},
"title": "use-reducer-async was vulnerable to malicious code execution via compromised commits"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48159",
"datePublished": "2026-08-10T17:55:45.932Z",
"dateReserved": "2026-05-20T23:12:43.031Z",
"dateUpdated": "2026-08-11T02:04:18.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.