PT-2025-90: Local Privilege Escalation in SyncBackTouch

The vulnerability was identified in SyncBackTouch, version 1.7.9.0. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 14.07.2025 Recommendations: Update to version 1.7.12 ...

CVE-2025-52363

The Tenda CP3 Pro smart wireless PTZ camera (Firmware V22.5.4.93 ) contains a security vulnerability due to the presence of a hardcoded root password hash within the /etc/passwd and /etc/passwd- files. An attacker who obtains access to the firmware image can extract this hash and attempt to crack...

CVE-2025-7503

An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service port 23 with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user manual. An attacker with...

CVE-2025-52983

A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines RE, even if the configured public key for root has been removed, remote users which are i...

CVE-2025-7503

CVE-2025-7503 affects Shenzhen Liandian OEM IP camera (AppFHE1_V1.0.6.0) where a Telnet service (port 23) is enabled by default and protected by undocumented, hard-coded credentials. A root-level shell can be obtained over the network, enabling remote code execution and privilege escalation. The ...

CVE-2025-52988

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted argument...

CVE-2025-52954

A Missing Authorization vulnerability in the internal virtual routing and forwarding VRF of Juniper Networks Junos OS Evolved allows a local, low-privileged user to gain root privileges, leading to a system compromise. Any low-privileged user with the capability to send packets over the internal...

CVE-2025-52988 Junos OS and Junos OS Evolved: Privilege escalation to root via CLI command 'request system logout'

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted argument...

CVE-2025-30661 Junos OS: Low-privileged user can cause script to run as root, leading to privilege escalation

An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileged user to install scripts to be executed as root, leading to privilege escalation. A local user with access to the local file system can...

Exploit for Incorrect Authorization in Sudo_Project Sudo

CVE-2025-32462-32463-Detection-Script- Critical Sudo Vulnerabi...

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

...

Sudo before 1.9.17p1 allows local users to obtain root access

...

CVE-2025-52983: UI Discrepancy for Security Feature

A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines RE, even if the configured public key for root has been removed, remote users which are i...

CBL Mariner 2.0 Security Update: cloud-init (CVE-2024-6174)

The version of cloud-init installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6174 advisory. - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP...

Azure Linux 3.0 Security Update: sudo (CVE-2025-32463)

The version of sudo installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-32463 advisory. - Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user- controll...

CBL Mariner 2.0 Security Update: sudo (CVE-2025-32463)

The version of sudo installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-32463 advisory. - Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user- controll...

libblockdev: LPE from allow_active to root in libblockdev via udisks

A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...

CVE-2025-25270

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations...

Important: cloud-init

Issue Overview: When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration. CVE-2024-6174 Affected Packages: cloud-init Note: This advisory is applicable to Amazon...

CVE-2025-47811

In Wing FTP Server through 7.4.4, the administrative web interface listening by default on port 5466 runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands i.e., through the web console or the task scheduler, and they are...