CVE-2026-3823

CriticalCVSS 9.8/10Last modified Jul 7, 2026

Description

EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Atop Technologies	EHG2408	< 3.36
Atop Technologies	EHG2408-2SFP	< 3.36

References

https://www.twcert.org.tw/en/cp-139-10753-e091e-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10752-5a4d9-1.htmlThird Party Advisory

Timeline

Published: Mar 9, 2026
Last modified: Jul 7, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-38246.1IFTOP developed by WellChoose has an Open redirect vulnerability, allowing authenticated remote attackers to craft a URL that tricks users i CVE-2026-38256.1IFTOP developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitra CVE-2026-38269.8IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code CVE-2026-38287.2Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficie CVE-2026-38295.4The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unautho CVE-2026-38308.6The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL st CVE-2026-38314.3The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing CVE-2026-38323.7A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status P CVE-2026-383299.8Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api CVE-2026-38337.4A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specif CVE-2026-383322.9TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.CVE-2026-383436.5An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (Do