CVE-2026-21891: fallo crítico en IceWhaleTech ZimaOS
ZimaOS has Authentication Bypass via System-Level Username
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
65Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.4epss 2.3%
de la publicación al arma
Publicada en NVD8 ene
VulnCheck+58d
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Productos afectados
IceWhaleTech · ZimaOSCVEs relacionadas — IceWhaleTech ZimaOS
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-49357HIGHZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data LeakEPSS 23.7%CVE-2024-49359HIGHZimaOS vulnerable to Directory Listing via Parameter ManipulationEPSS 1.0%CVE-2024-48931HIGHZimaOS Arbitrary File Read via Parameter ManipulationEPSS 0.7%CVE-2024-48932MEDIUMZimaOS Unauthenticated API Discloses UsernamesEPSS 0.5%CVE-2024-49358MEDIUMZimaOS vulnerable to Username Enumeration via API ResponsesEPSS 0.5%CVE-2026-28286HIGHZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via APIEPSS 0.5%