🟠 《高危安全漏洞：CVE-2026-8170》

CVSS 评分: 高危（8.7）　　状态: Received　　发布时间: 2026-07-20

漏洞描述

The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console.

🔍 技术细节

字段 值
CVE ID CVE-2026-8170
CVSS 评分 8.7 🟠
严重程度 高危
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-59
发布时间 2026-07-20
最后更新 2026-07-20
状态 Received
数据来源 1c053176-eef3-4d6a-ae0b-24728c86587b

🔗 参考链接