Georitm - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/georitm/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 16:37:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGEOritm: Unauthenticated information disclosure via REST API (CVE-2026-100903)https://feed.craftedsignal.io/briefs/2026-10-georitm-auth-bypass/Fri, 23 Oct 2026 16:37:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-georitm-auth-bypass/An authentication bypass vulnerability in the GEOritm REST API allows unauthenticated remote attackers to enumerate fleet assets and retrieve sensitive personal data via the /restapi/objects/obj-groups endpoint.GEOritm versions <= 2.45.1 contain a missing authentication vulnerability (CVE-2026-100903) in the POST /restapi/objects/obj-groups endpoint. Exploitation allows remote, unauthenticated attackers to query the API using an 'objectId' parameter to return organizational data, regional associations, and potentially the name and initials of the responsible driver. Enumeration of these identifiers enables deanonymization of monitored fleet objects.

Impact

Successful exploitation leads to unauthorized information disclosure of fleet telemetry and personally identifiable information (PII). Attackers can systematically enumerate monitored objects to map entire fleets.

Recommendation

  • Restrict network access to the GEOritm REST API to trusted internal management segments.
  • Review web server access logs for anomalous, high-volume POST requests to /restapi/objects/obj-groups originating from untrusted IP addresses.
  • Monitor for the deployment of enumeration scripts similar to the publicly released 'ritm_park_enum.sh'.
  • Verify current version of GEOritm and coordinate with the vendor (ООО НПО Ритм) for remediation paths beyond version 2.45.1.
]]>highadvisoryinformation-disclosureapi-vulnerabilitygeoritm