CVE-2026-28798: falha crítica em IceWhaleTech ZimaOS
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
IceWhaleTech · ZimaOSCVEs relacionadas — IceWhaleTech ZimaOS
No mesmo produto, das mais perigosas para as menos.
CVE-2024-49357HIGHZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data LeakEPSS 23.7%CVE-2026-21891CRITICALZimaOS has Authentication Bypass via System-Level UsernameEPSS 2.3%CVE-2024-49359HIGHZimaOS vulnerable to Directory Listing via Parameter ManipulationEPSS 1.0%CVE-2024-48931HIGHZimaOS Arbitrary File Read via Parameter ManipulationEPSS 0.7%CVE-2024-48932MEDIUMZimaOS Unauthenticated API Discloses UsernamesEPSS 0.5%CVE-2024-49358MEDIUMZimaOS vulnerable to Username Enumeration via API ResponsesEPSS 0.5%