CVE-2026-25086

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-605

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Mar 21, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-250877.0Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when CVE-2026-250888.8An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6 CVE-2026-250899.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 th CVE-2026-25096.4The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes fiel CVE-2026-250998.8Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, w CVE-2026-251005.4Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload p CVE-2026-251019.8Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. T CVE-2026-251047.8A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted CVE-2026-251058.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remo CVE-2026-251076.9ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who kn CVE-2026-251088.8FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciall CVE-2026-251098.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote