IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-26 10:16

MODIFIED

2026-01-26 10:16

EPSS (Prob. Exploit)

0.80%

Top 43.3%

DATA SOURCES:

NVD 🔗 2026-01-26 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08

> DESCRIPTION

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-272

> CWE DETAILED DESCRIPTIONS

CWE-272: Least Privilege Violation - The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

> HISTORIQUE DES MODIFICATIONS

Première apparition

26/01/2026 10:16

Source: NVD

📊 ENRICHISSEMENT 01/02/2026 06:45

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-272: Least Privilege Violation - The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://r.sec-consult.com/dkaccess

https://r.sec-consult.com/dormakaba

https://www.dormakabagroup.com/en/security-advisories