CVE-2026-42937

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-429418.3The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.CVE-2026-429447.5NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID a CVE-2026-429458.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite dire CVE-2026-429467.4A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an ov CVE-2026-429478.8A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device t CVE-2026-429484.8Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious d CVE-2026-42957.8Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat CVE-2026-429505.1ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while CVE-2026-429515.4An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password CVE-2026-429527.5Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to CVE-2026-429538.4The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past t CVE-2026-429553.7In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family o