CVE-2026-107510

Published: Oct 8, 2026Modified: Oct 9, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: f84ca5ce-fbe7-4668-8724-994599108a02 (Secondary)

Description

An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (2)

https://aumlayer.com/insights/administrator-is-not-root-infoblox-nios-privilege-escalation/

Source: f84ca5ce-fbe7-4668-8724-994599108a02

https://support.infoblox.com/s/article/Security-Advisory-NIOS-Maintenance-Mode-Permits-Root-Shell

Source: f84ca5ce-fbe7-4668-8724-994599108a02

Timeline

No history available yet.