[Content]
Forwarded from TWCERTCC-200-202603-00000001

【CVE-2026-25108】Soliton Systems K.K FileZen OS Command Injection Vulnerability (CVSS v3.1: 8.8)

【Exploited by Ransomware: Unknown】 Soliton Systems K.K FileZen contains an operating system command injection vulnerability. When a user logs in to the affected product and sends a specially crafted HTTP request, this vulnerability may be triggered.

【CVE-2022-20775】Cisco SD-WAN Path Traversal Vulnerability (CVSS v3.1: 7.8)

【Exploited by Ransomware: Unknown】 Cisco SD-WAN CLI contains a path traversal vulnerability. Due to improper command access control within the application CLI, an authenticated local attacker may exploit this vulnerability to escalate privileges. Successful exploitation could allow the attacker to execute arbitrary commands as the root user.

【CVE-2026-20127】Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (CVSS v3.1: 10.0)

【Exploited by Ransomware: Unknown】 Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) contain an authentication bypass vulnerability. This vulnerability may allow an unauthenticated remote attacker to bypass authentication mechanisms and obtain administrative privileges on the affected system.

(Information Sharing Level: WHITE (Information content can be publicly disclosed)

[Affected Platform]
【CVE-2026-25108】Please refer to the affected versions listed on the official website: https://www.soliton.co.jp/support/2026/006657.html

【CVE-2022-20775】Please refer to the affected versions listed on the official website: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

【CVE-2026-20127】Please refer to the affected versions listed on the official website: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

[Recommended Actions]
【CVE-2026-25108】 The vendor has released a security update to address this vulnerability. Please update to the relevant fixed version: https://www.soliton.co.jp/support/2026/006657.html

【CVE-2022-20775】 The vendor has released a security update to address this vulnerability. Please update to the relevant fixed version: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

【CVE-2026-20127】 The vendor has released a security update to address this vulnerability. Please update to the relevant fixed version: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk