Loading story…
CERT Polska disclosed two vulnerabilities in ICU Scandinavia Boomerang that could let unauthenticated remote attackers access sensitive data and interact with system functions without authorization. The issues, tracked as CVE-2026-46458 and CVE-2026-46459, affect all versions before 2.4.18.029 and were publicly listed alongside a brief industry notice highlighting the affected product and CVE identifiers.
CVE-2026-46458 allows plaintext service account and SMTP credentials to be retrieved from XML files exposed over static HTTP because the credentials were insufficiently protected. CVE-2026-46459 is a missing authorization flaw in device receiver endpoints that can let unauthenticated attackers read full facility configurations and write unauthorized data to the sensor database. ICU Scandinavia fixed both flaws in Boomerang 2.4.18.029 after responsible reporting by Marek Figielski of vanilla.pl, with disclosure coordinated by CERT Polska.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-15, CERT Polska disclosed two vulnerabilities in ICU Scandinavia Boomerang: an information disclosure issue exposing plaintext credentials and a missing authorization flaw enabling unauthorized configuration access and sensor database writes.
The two vulnerabilities, CVE-2026-46458 and CVE-2026-46459, were fixed in Boomerang version 2.4.18.029. All versions before 2.4.18.029 are affected.
Marek Figielski of vanilla.pl responsibly reported two vulnerabilities affecting ICU Scandinavia Boomerang, and CERT Polska coordinated the disclosure process.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
Silex Technology's **SD-330AC** and **AMC Manager** were disclosed with two serious vulnerabilities that expose devices to remote compromise and unauthorized reconfiguration. The most severe issue, `CVE-2026-32956`, is a **heap-based buffer overflow** in redirect URL processing that can enable **arbitrary code execution** over the network without authentication or user interaction. The flaw is tracked as `CWE-122` and carries a critical `CVSS v3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating full compromise of confidentiality, integrity, and availability is possible. A second flaw, `CVE-2026-32965`, affects devices left in their **factory-default state** and allows them to be configured with a **null string password**, creating an insecure initialization condition. Classified as `CWE-1188`, the vulnerability is network-accessible and primarily threatens device integrity, with a `CVSS v3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`. The issues were reported through **JPCERT/CC** and published via **JVN** and Silex security advisories in Japanese and English, putting administrators on notice to review exposed deployments and initialization practices.
Jun 29, 2026
**CISA** published an ICS advisory warning that **Johnson Controls Frick Controls Quantum HD** (versions **10.22 and earlier**) contains multiple vulnerabilities that can be exploited **before authentication**, enabling **remote code execution (RCE)**, **information leakage**, and potentially **denial of service** in environments where the product is deployed (noted as worldwide, including **Food and Agriculture** critical infrastructure). CISA lists a **CVSS v3.1 base score of 9.1 (Critical)** for the issue set and attributes the root cause across several items to **insufficient input validation** in device parameters. The disclosed CVEs include **CVE-2026-21654** (**OS command injection**, CWE-78) and several **code injection** RCE issues (**CVE-2026-21656**, **CVE-2026-21657**, **CVE-2026-21658**, **CWE-94**) that could allow unexpected actions and system compromise without credentials. **CVE-2026-21659** describes **local file inclusion (LFI)** (CWE-23) leading to **unauthenticated RCE and information disclosure**, explicitly stating an attacker could execute arbitrary code and achieve **full system compromise** on affected devices. The advisory also references an additional CVE (**CVE-2026-21660**) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.
Jun 29, 2026