CVE-2026-7834

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
EFM	ipTIME NAS1dual	1.5.24

References

Timeline

Published: May 5, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-783406.7Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricte CVE-2026-783417.2Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high pr CVE-2026-78353.1A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service CVE-2026-783558.7A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths out CVE-2026-783565.3The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve CVE-2026-783579.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its pa CVE-2026-783584.3Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In part CVE-2026-783595.4OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multipl CVE-2026-78363.1An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote CVE-2026-783619.1The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its f CVE-2026-783629.8The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing CVE-2026-783634.8The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those v