CVE-2026-35084

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
MBS	Single-A	>= V1_00_00, < V6_00_07
MBS	Double-A Profibus	>= V1_00_00, < V6_00_07
MBS	Double-A x-link	>= V1_00_00, < V6_00_07
MBS	Single-X	>= V1_00_00, < V6_00_07
MBS	Double-X CAN	>= V1_00_00, < V6_00_07
MBS	Double-X DALI	>= V1_00_00, < V6_00_07
MBS	Double-X KNX	>= V1_00_00, < V6_00_07
MBS	Double-X LON	>= V1_00_00, < V6_00_07
MBS	Double-X M-Bus	>= V1_00_00, < V6_00_07
MBS	Double-X PROFINET	>= V1_00_00, < V6_00_07
MBS	Double-X x-link	>= V1_00_00, < V6_00_07
MBS	Triple-X KNX+DALI	>= V1_00_00, < V6_00_07
MBS	Triple-X KNX+LON	>= V1_00_00, < V6_00_07
MBS	Triple-X KNX+M-Bus	>= V1_00_00, < V6_00_07
MBS	Triple-X PROFINET+DALI	>= V1_00_00, < V6_00_07
MBS	Triple-X PROFINET+KNX	>= V1_00_00, < V6_00_07
MBS	Triple-X PROFINET+LON	>= V1_00_00, < V6_00_07
MBS	Triple-X PROFINET+M-Bus	>= V1_00_00, < V6_00_07

References

https://www.certvde.com/en/advisories/VDE-2026-039/Vendor Advisory

Timeline

Published: Jun 3, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-350858.8A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.CVE-2026-350866.5Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz:CVE-2026-350879.3Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials b CVE-2026-350888.2Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker CVE-2026-350898.7In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtain CVE-2026-35097.5An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control ru CVE-2026-350909.3In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via CVE-2026-350918.2A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership co CVE-2026-350927.5A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticate CVE-2026-350938.8A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration d CVE-2026-350945.5A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling point CVE-2026-350954.8KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its va