CVE-2026-57223

Katalog CVE

CVSS 7.0 · High EPSS 0,15%

Kerentanan Unquoted Search Path or Element pada oisf suricata. Skor CVSS 3.1 7.0 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.0 (High), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-428: Unquoted Search Path or Element

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp mitigasi · advisory vendor
• https://redmine.openinfosecfoundation.org/issues/8600 issue tracking · advisory vendor
• https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e patch
• https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38 patch
• https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d patch
• https://github.com/OISF/suricata/pull/15676 patch
• https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 release notes
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes