Rockwell, Cisco Flaws Hit KEV; Zlib, Libsoup Vulnerabilities Disclosed

A critical vulnerability in Rockwell Automation's 1715-AENTR EtherNet/IP Adapter (CVE-2026-10577) allows unauthenticated remote attackers to gain intrusive command-line access due to an exposed debug port lacking proper privilege controls. This flaw poses a significant risk to industrial control systems. As detailed in a CISA ICS Advisory, the vulnerability could enable unauthorized manipulation of critical infrastructure.

CISA has added CVE-2008-4128, a cross-site request forgery vulnerability in Cisco IOS 12.4 on the 871 Integrated Services Router, to its Known Exploited Vulnerabilities (KEV) catalog. This decades-old flaw allows remote attackers to execute arbitrary commands by tricking authenticated users into visiting a malicious link. Multiple advisories, including CISA Alerts and Cyber Security News, highlight the ongoing threat and the need for improved router hygiene, particularly against state-sponsored actors.

Several vulnerabilities have been disclosed in zlib, a widely used data compression library. CVE-2016-9841 and CVE-2016-9840, both involving improper pointer arithmetic, and CVE-2016-9842, related to left shifts of negative integers, could lead to unspecified impacts. Additionally, Node.js versions prior to 4.8.5, 6.11.5, and 8.8.0 are affected by CVE-2017-14919, a denial-of-service vulnerability stemming from changes in the zlib module's windowBits parameter handling. These flaws, while older, underscore the persistent risks associated with foundational libraries.

A Bash script injection vulnerability (CVE-2014-5287) affects Kemp Load Master versions 7.1-16 and earlier. The flaw arises from insufficient input sanitization in the Web User Interface (WUI), potentially allowing attackers to inject and execute arbitrary commands. This highlights the importance of robust input validation in web-facing management interfaces.

Suricata, an open-source intrusion detection system, has a privilege escalation vulnerability (CVE-2026-59674) that could be exploited through symbolic link following. This allows a local attacker to gain higher privileges on the system, potentially compromising the security monitoring capabilities.

Libsoup, a GNOME library for applications that use the network, has multiple disclosed vulnerabilities. These include remote denial-of-service flaws related to WebSocket protocol violations (CVE-2026-15711, CVE-2026-15709), an out-of-bounds read in multipart stream handling (CVE-2026-15714), and HTTP/2 frame window exhaustion and heap buffer over-reads (CVE-2026-15713, CVE-2026-15712). These collectively indicate potential instability and security weaknesses in network communication handling.

Debian's gawk package is affected by several integer overflow and use-after-free vulnerabilities in versions 5.4.0 and below. CVE-2026-40469 and CVE-2026-40468 describe integer overflows in the builtin.c file that could lead to heap corruption or memory exhaustion, while CVE-2026-40467 in io.c is a use-after-free flaw. These issues, as noted in a Rapid7 Blog, could result in crashes or facilitate further exploitation.