Forwarded from TWCERTCC Security Advisory TWCERTCC-200-202606-00000018

【CVE-2025-67038】Lantronix EDS5000 Code Injection Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 Lantronix EDS5000 has a code injection vulnerability. An attacker may exploit this vulnerability to inject arbitrary operating system commands into the username parameter and execute them with root privileges.

【CVE-2026-34910】Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】 Ubiquiti UniFi OS has an improper input validation vulnerability. A malicious attacker with network access may exploit this vulnerability to perform a command injection attack.

【CVE-2026-34909】Ubiquiti UniFi OS Path Traversal Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】 Ubiquiti UniFi OS has a path traversal vulnerability. A malicious attacker with network access may exploit this vulnerability to access files on the underlying system, and may further obtain access privileges to an underlying system account by manipulating or exploiting these files.

【CVE-2026-34908】Ubiquiti UniFi OS Improper Access Control Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】 Ubiquiti UniFi OS has an improper access control vulnerability. A malicious attacker with network access may exploit this vulnerability to make unauthorized changes to the system.

【CVE-2026-12569】PTC Windchill and FlexPLM Improper Input Validation Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 PTC Windchill and FlexPLM have an improper input validation vulnerability. An unauthenticated remote attacker may execute arbitrary code by sending malicious requests to the network.

【CVE-2026-20230】Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (CVSS v3.1: 8.6)
【Whether exploited by ransomware: Unknown】 Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) have a server-side request forgery vulnerability. An unauthenticated remote attacker may exploit this vulnerability to write files to the underlying operating system and subsequently use these files to further elevate privileges to root.