The article details multiple actively exploited vulnerabilities, including a critical Linux kernel improper authentication flaw (CVE-2022-0492, CVSS 7.8) affecting specific NetApp firmware versions, a high-severity Android Framework integer overflow (CVE-2025-48595, CVSS 8.4) impacting Android versions 14.0 through 16.0, and a critical Cisco Unified Communications Manager Server-Side Request Forgery vulnerability (CVE-2026-20230, CVSS 8.6) allowing root access. It also highlights a new Cisco Catalyst SD-WAN Manager zero-day (CVE-2026-20245, CVSS 7.8) under active attack with no patch available and a critical unauthenticated stack buffer overflow in HP Poly VVX VoIP phones (CVE-2026-0826). CERT-IS and CISA recommend applying vendor-provided patches immediately where available.
Frettasafn / frett / Fréttir Veikleikar í Android, Cisco, Acer Wave 7, HP Poly VVX og Trio VoIP 8. júní 2026 Veikleikar í Android, Cisco, Acer Wave 7, HP Poly VVX og Trio VoIP CERT-IS mælir með að uppfært sé eins fljótt og auðið er í útgáfu þar sem veikleikarnir hafa verið lagfærðir. CISA KEV (CVE-2022-0492) (CVSSv3 7.8) CISA hefur bætt nýjum veikleika á lista sinn yfir þekkta veikleika (KEV) sem eru í virkri nýtingu. Veikleikinn er „Linux Kernel Improper Authentication Vulnerability“. https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog (CVE-2025-48595) (CVSSv3 8.4) CISA hefur bætt nýjum veikleika á lista sinn yfir þekkta veikleika (KEV) sem eru í virkri nýtingu. Veikleikinn er „Android Framework Integer Overflow Vulnerability“. https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog Cisco CallManager (CVE-2026-20230) (CVSSv3 8.6) Cisco hefur gefið út öryggisuppfærslu til að lagfæra alvarlegan veikleika á „Unified Communications Manager“. En veikleikinn gerði ógnaraðilum kleift að komast yfir rótar réttindi. https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-unified-cm-flaw-with-poc-exploit-code/ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW https://thehackernews.com/2026/06/cisco-patches-cve-2026-20230-in-unified.html https://www.securityweek.com/cisco-warns-of-available-poc-for-critical-unified-cm-vulnerability/ https://securityaffairs.com/193142/hacking/critical-cisco-unified-cm-bug-patched-as-public-exploit-code-emerges.html Cisco SD-Wan Nýveila (CVE-2026-20245) (CVSSv3 7.8) Cisco hefur gefið út aðvörun vegna nýtingur á nýveilu til árása. Veikleikinn er á „Cisco Catalyst SD-WAN Manager“. Hann er í virkri nýtingu af ógnaraðilum og gerir ógnaraðilum með lítil réttindi kleift að keyra skipanir sem rót. https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-manager-cve-2026.html https://www.securityweek.com/cisco-warns-of-7th-sd-wan-zero-day-exploited-in-2026/ https://securityaffairs.com/193203/security/cisco-sd-wan-has-a-new-root-level-problem-and-theres-no-fix-yet.html https://www.theregister.com/security/2026/06/05/yet-another-cisco-sd-wan-0-day-under-attack-and-no-patch-in-sight/5251855 https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/ HP Poly VVX og Trio VoIP símar (CVE-2026-0826) (CVSSv3 ?.?) Rannsókn á vegum Rapid7 á HP Poly VVX 450 VoIP síma leiddi í ljós „unauthenticated stack-based buffer overflow “ veikleika. Ógnaraðili getur nýtt sér veikleikann til óauðkenndar keyrslu á kóða með rótar aðgangi á viðkomandi tæki. https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed/ https://www.securityweek.com/critical-vulnerability-in-hp-voip-phones-enables-enterprise-network-breaches/ Acer Wave 7 Router (CVE-2026-49200) (CVE-2026-49201) (CVSSv3 ?.?) (CVSSv3 ?.?) Acer hafa staðfest að þeir eru að vinna í lagfæringu á tveimur nýveilum á Wave 7 mesh netbeinum. CVE-2026-49200 veikleikinn gerir óauðkenndum ógnaraðilum kleift að komast yfir ódulkóðuð auðkenni notanda. Seinni veikleikinn CVE-2026-49201 tengist harðkóðuðum dulkóðunarlykli sem veitir ógnaraðilum án réttinda þrálátan bakdyra aðgang að netbeininum. https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/ DoS árás: HTTP/2 Bomb Ný gerð af DoS (e. Denial-of-service) áras frá stakri vél tekur niður netþjóna á örskotsstundu. Árásin nýtir sér sjálfgefnar HTTP/2 stillingar á þekktum netþjónum. Þar með töldum, NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. https://www.bleepingcomputer.com/news/security/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute/ https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb http://github.com/califio/publications/tree/main/MADBugs/http2-bomb https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html https://www.securityweek.com/http-2-bomb-exploit-knocks-web-servers-offline-in-seconds/ Category: Veikleikatilkynningar Facebook Twitter Linkedin Google-plus-g Pinterest Envelope