Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta de desbordamiento de búfer en SIPp 3.7.7 y versiones anteriores

SIPp versiones hasta 3.7.7 contiene un desbordamiento de búfer en la función get_header() que permite a atacantes no autenticados enviar mensajes SIP con encabezados superiores a 20,490 bytes para causar crasheo del proceso. Esta vulnerabilidad afecta servidores VoIP y sistemas de prueba de telefonía en infraestructuras empresariales de LATAM. El impacto incluye negación de servicio en infraestructuras de comunicaciones altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta de desbordamiento de búfer en SIPp 3.7.7 y anteriores

SIPp versiones hasta 3.7.7 contiene un desbordamiento de búfer en la función get_peer_tag() al procesar encabezados SIP con parámetros de etiqueta superiores a 2048 bytes. Atacantes no autenticados pueden enviar mensajes SIP manipulados para causar el bloqueo de procesos en servidores de comunicaciones VoIP y telefonía empresarial. Este riesgo afecta infraestructuras de telefonía en la nube y sistemas PBX que implementen SIPp.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58823] In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missi…

In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58839] In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow…

In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-55277] In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to…

In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-55285] In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bo…

In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta de desbordamiento de buffer en Tenda HG10 300001138

Se identificó una vulnerabilidad en el componente Boa Web Server del router Tenda HG10 (modelo 300001138) que permite desbordamiento de buffer mediante manipulación del parámetro 'if' en la función formWanRedirect. El exploit ha sido divulgado públicamente y puede ser explotado de forma remota. Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en México y Latinoamérica que utilizan este dispositivo como router de acceso a Internet o en infraestructuras de red.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85110] A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of th…

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-83596] A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to i…

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75124] PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vu…

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an ove…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta de buffer overflow en BlueZ afecta stack Bluetooth de Linux

Una vulnerabilidad de desbordamiento de búfer en la pila Bluetooth de Linux (BlueZ) permite a atacantes remotos dentro del rango de radio enviar paquetes Extended Inquiry Response (EIR) malformados que causan bloqueos del servicio bluetoothd. Afecta servidores Linux, dispositivos IoT y sistemas embebidos comunes en infraestructura LATAM, con potencial de denegación de servicio y ejecución de código remoto.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-71399] Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code executio…

Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-19568] A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption …

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71938] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp f…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71939] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid admini…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71940] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid admin…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71941] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail func…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. E…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71942] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert fu…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands.…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71934] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace functio…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71935] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction f…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbit…

nvdaltovulnerabilidad CVSS 7.2 NVD