CVE-2026-90442

HighCVSS 8.6/10Last modified Nov 4, 2026

Description

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121 CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no CVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An CVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted CVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli CVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr CVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo CVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role re CVE-2026-904515.9An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled CVE-2026-904525.3Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify t CVE-2026-904533.5A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without