Loading vulnerability…
Rejetto HFS versions 3.0.0 through 3.2.0 generates its session-cookie signing key using the non-cryptographic Math.random() pseudo-random number generator. The application also exposes outputs from that generator to unauthenticated clients during login. An attacker can collect login responses, reconstruct the generator state, recover the signing key, and create a forged administrator session cookie. The forged session grants administrative access that can be used to execute code through the server_code configuration feature.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This 15-file repository is a standalone Python proof of concept for CVE-2026-61500, an unauthenticated predictable-PRNG flaw in Rejetto HFS 3.0.0 through 3.2.0. The main cve-2026-61500-poc.py script uses only Python standard-library HTTP functionality. It requests six unauthenticated loginSrp1 responses for the admin account, converts exposed numeric login SIDs into V8 xorshift128+ observations, brute-forces omitted state bits, reconstructs PRNG state, reproduces the HFS random signing-key generation, and validates candidates against the hfs_http.sig HMAC. It then signs a synthetic admin session, calls get_config as an authorization probe, and uses set_config to install server_code for code execution. The normal payload writes a benign confirmation file; --command enables shell command execution, and demo.sh demonstrates a reverse shell solely within the Docker Compose network. The repository also includes a controlled vulnerable-versus-fixed Docker test harness. lab/docker-compose.yml pins HFS 3.2.0 on 127.0.0.1:28182 and fixed HFS 3.2.1 on 127.0.0.1:28183, both with no-new-privileges enabled. verify.sh creates disposable runtime directories, installs synthetic HFS admin configurations, verifies exploitation of 3.2.0, and confirms that 3.2.1 supplies an opaque UUID login SID and causes the PoC to stop before forgery. lab/callback-server.py is a one-connection TCP recorder for the demo reverse shell and sends only fixed id, uname -a, pwd, and exit commands. README.md, SUBMISSION.md, docs/example-output.txt, docs/e2e-results.json, and the Asciinema recording document the mechanism and claimed lab results. This is a real exploit rather than a scanner: it forges privileged state and changes HFS configuration to execute code, although the released build deliberately rejects non-loopback and HTTPS targets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.