Unauthorized-Access — CraftedSignal Threat Feed

Anviz CX2 Lite Authenticated Command Injection Vulnerability (CVE-2026-35682)

hello@craftedsignal.io — Fri, 17 Apr 2026 20:16:35 +0000

CVE-2026-35682 describes an authenticated command injection vulnerability in Anviz CX2 Lite devices. An attacker with valid user credentials can inject arbitrary commands into the filename parameter, leading to remote code execution with root privileges. The vulnerability allows an attacker to execute commands like starting telnetd, effectively gaining complete control over the device. This poses a significant risk to organizations using vulnerable Anviz CX2 Lite devices for access control or time attendance, potentially leading to unauthorized access, data breaches, or denial-of-service conditions. The ICS-CERT advisory, ICSA-26-106-03, provides additional details.

Attack Chain

An attacker gains valid credentials for an Anviz CX2 Lite device.
The attacker authenticates to the device’s web interface or API.
The attacker identifies the vulnerable filename parameter in a specific request.
The attacker crafts a malicious request containing a command injection payload within the filename parameter (e.g., filename=;telnetd -p 1337 -l /bin/sh;).
The Anviz CX2 Lite device processes the request, improperly sanitizing the filename parameter.
The injected command executes with root privileges on the device.
The attacker uses the executed command to start a service like telnetd.
The attacker connects to the newly started service, gaining a root shell and complete control of the device.

Impact

Successful exploitation of CVE-2026-35682 allows a remote attacker to gain root-level access to the Anviz CX2 Lite device. This can lead to complete system compromise, including unauthorized access to sensitive data, modification of device settings, and potential use of the device as a foothold for further attacks within the network. Given that these devices are often used for physical access control, this vulnerability could lead to unauthorized physical access to secured areas.

Recommendation

Apply available patches or firmware updates from Anviz to remediate CVE-2026-35682. Contact Anviz directly through their website for support and remediation steps (https://www.anviz.com/contact-us.html).
Deploy the Sigma rule Detect Anviz CX2 Lite Command Injection Attempt to identify exploitation attempts against the device.
Monitor web server logs for suspicious requests containing command injection payloads in the filename parameter to identify potential exploitation attempts.
Review authentication logs for unauthorized access attempts to the Anviz CX2 Lite devices.

LearnPress WordPress Plugin Unauthorized Data Deletion Vulnerability (CVE-2026-4365)

hello@craftedsignal.io — Tue, 14 Apr 2026 02:16:57 +0000

The LearnPress plugin for WordPress, in versions up to and including 4.3.2.8, is susceptible to unauthorized data deletion. The vulnerability stems from a missing capability check on the delete_question_answer() function. The plugin exposes a wp_rest nonce in public frontend HTML, and this nonce serves as the sole security check for the lp-load-ajax AJAX dispatcher. As the delete_question_answer action lacks capability or ownership validation, unauthenticated attackers can exploit this flaw to delete arbitrary quiz answer options. This is achieved by sending a crafted POST request containing a publicly available nonce. Exploitation does not require any prior authentication.

Attack Chain

An unauthenticated attacker identifies a LearnPress installation with a vulnerable version (<= 4.3.2.8).
The attacker accesses the public frontend of the WordPress site.
The attacker retrieves the wp_rest nonce from the lpData variable in the HTML source code. This nonce is used for AJAX requests.
The attacker crafts a POST request to the wp-admin/admin-ajax.php endpoint.
The crafted POST request includes the action parameter set to delete_question_answer.
The request also includes the nonce parameter with the value of the retrieved wp_rest nonce.
The request includes the answer_id parameter set to the ID of the quiz answer option to be deleted.
The server, lacking proper capability checks, processes the request and deletes the specified quiz answer option from the database. This results in data loss and potentially disrupts the functionality of quizzes within the LearnPress plugin.

Impact

Successful exploitation allows unauthenticated attackers to arbitrarily delete quiz answer options within the LearnPress plugin. This can lead to data loss, disruption of quizzes, and potentially compromise the integrity of educational content. The CVSS v3.1 base score for this vulnerability is 9.1, indicating a critical severity. The number of victims and specific sectors targeted are currently unknown, but any website using the vulnerable LearnPress plugin is at risk.

Recommendation

Upgrade the LearnPress plugin to a version greater than 4.3.2.8 to patch CVE-2026-4365.
Deploy the Sigma rule “Detect LearnPress Unauthorized Data Deletion Attempt” to your SIEM to identify potential exploitation attempts.
Monitor web server logs for POST requests to wp-admin/admin-ajax.php with the action parameter set to delete_question_answer and investigate suspicious activity.

Red Hat OpenShift AI Llama Stack Unauthorized Access Vulnerability (CVE-2025-12805)

hello@craftedsignal.io — Fri, 27 Mar 2026 10:00:00 +0000

A vulnerability, CVE-2025-12805, has been identified in Red Hat OpenShift AI (RHOAI) llama-stack-operator. The vulnerability stems from the lack of NetworkPolicy restrictions on the llama-stack service endpoint. This allows a user within one namespace to bypass intended isolation and directly access Llama Stack services deployed in other namespaces. The vulnerability was published on March 26, 2026. Successful exploitation could lead to unauthorized data access and manipulation, impacting the…

Azure AD Authentication from Unexpected Geo-locations

hello@craftedsignal.io — Mon, 29 Jan 2024 18:22:00 +0000

This brief addresses the risk of unauthorized access to Azure Active Directory (Azure AD) resources stemming from successful authentication events originating from unexpected geographic locations. While the source material does not attribute this activity to a specific threat actor, such access can be indicative of compromised user accounts, sophisticated phishing attacks, or insider threats. The focus is on detecting deviations from established operational norms, where user logins typically originate from known and trusted countries. By monitoring sign-in logs, security teams can identify potentially malicious activity that bypasses standard security controls and warrants further investigation. Effective detection relies on maintaining an accurate list of countries where the organization operates.

Attack Chain

Credential Compromise: An attacker obtains valid user credentials through phishing, malware, or credential stuffing.
Initial Access: The attacker leverages the compromised credentials to attempt authentication to Azure AD.
Authentication Request: The attacker initiates a sign-in request to Azure AD from an IP address associated with an unexpected geographic location.
Bypass MFA (if present): If multi-factor authentication (MFA) is enabled, the attacker may attempt to bypass it through techniques like MFA fatigue or SIM swapping.
Successful Authentication: The attacker successfully authenticates to Azure AD, gaining access to cloud resources and applications.
Privilege Escalation: The attacker attempts to escalate privileges within the Azure AD environment to gain broader access.
Lateral Movement: The attacker moves laterally within the cloud environment, accessing sensitive data and resources.
Data Exfiltration / Persistence: The attacker exfiltrates sensitive data or establishes persistent access for future malicious activity.

Impact

Successful exploitation can lead to significant data breaches, financial loss, and reputational damage. The extent of the impact depends on the level of access gained by the attacker and the sensitivity of the compromised data. Organizations may face regulatory fines, legal action, and loss of customer trust. The absence of geographic restrictions on authentication increases the attack surface and elevates the risk of unauthorized access from malicious actors operating outside of the organization’s control.

Recommendation

Deploy the Sigma rule provided to detect successful authentications from countries outside of the organization’s operational footprint, based on the Location field in Azure AD sign-in logs.
Maintain and regularly update a whitelist of countries where the organization operates to ensure the accuracy of the filter in the Sigma rule.
Investigate any alerts generated by the Sigma rule to determine the legitimacy of the sign-in event and the potential compromise of the user account.
Enforce multi-factor authentication (MFA) for all users to mitigate the risk of credential compromise, although attackers may attempt to bypass MFA.