Vista Net, Inc.

Vista Net, Inc. Norther California's most trusted and experienced computer network integration and cloud specialists VistaNet Inc.

is Northern California's premier Network Integrator and Internet Service Provider specializing in technology solutions for corporate, education, government, and non-profits entities. We offer a complete line of products and services to meet the technology needs of every organization. As the North Valley's technology leader we continually strive to provide the highest level of technical support for

our clients. From small peer to peer networks to large, complex enterprise networks and beyond, VistaNet is your technology partner.

VU #456290: Hugging Face Transformers library writes remote code to disk prior to consent checkOverview A vulnerability ...
09/01/2026

VU #456290: Hugging Face Transformers library writes remote code to disk prior to consent check

Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. Description Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code(). Although ex*****on of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious custom_generate/generate.py file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt. Impact The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended ex*****on of cached code. Solution At the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking load_custom_generate() with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (~/.cache/huggingface/modules) to remove unexpected content. Implementations should ensure that trust_remote_code checks occur prior to any remote content retrieval or local file writes. Acknowledgements Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.

https://www.vistanetinc.com/vu456290-hugging-face-transformers-library-writes-remote-code-to-disk-prior-to-consent-check/?utm_source=facebook&utm_medium=jetpack_social

Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust...

VU #728712: Konami’s Metal Gear Online 3 contains a heap-based buffer overflowOverview Konami's Metal Gear Online 3 vide...
08/29/2026

VU #728712: Konami’s Metal Gear Online 3 contains a heap-based buffer overflow

Overview Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data. Description Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches. As detailed in CVE‑2026‑19874, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) contains an input‑validation vulnerability in the processing of Steam lobby metadata related to the player‑removal feature. The game tracks a lobby field (kick_num) indicating the number of players designated for removal, along with corresponding Steam ID entries of each kicked player (kicked_id_%i). When joining a lobby, the player's client parses these fields to check whether its own Steam ID is on the list, and if so, the player is prevented from joining the match. The function responsible for parsing this lobby data does not validate the kick_num value against the size of the fixed‑length buffer allocated for kicked player identifiers. Supplying a kick_num value larger than the buffer capacity results in out‑of‑bounds writes into adjacent memory. The memory region immediately following this buffer contains internal Steamworks callback handler structures that store function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback ex*****on, resulting in control‑flow hijacking on affected client systems. The vulnerability can be triggered automatically when a client joins a lobby controlled by an attacker. Impact Exploitation of this vulnerability may allow remote code ex*****on on affected clients. Initial control‑flow hijacking provides access only to existing in‑process code; however, the Metal Gear Online 3 binary includes Denuvo‑protected regions mapped with read‑write‑execute (RWX) permissions. These regions permit runtime injection of attacker‑supplied code, significantly increasing the severity of the issue. An attacker hosting a lobby can achieve code ex*****on on any client that joins, without requiring further interaction from the victim. Additionally, because host privileges are automatically reassigned to another lobby participant when the current host exits, an attacker can obtain host control during an active match and subsequently deliver the malicious lobby data to all connected players. This enables compromise of multiple systems through a single exploitation event. Solution As of this writing, Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, mgsvmgo.exe. The patch also iterated the server and lobby version numbers from 15 to 16 and 150 to 160, respectively, to prevent players on older versions from accessing the online services. This is the latest patch that fixed the vulnerability: The full patch list can be found here: Acknowledgements Thank you to Alice Cecchetto for reporting this vulnerability. This document was written by Bob Kemerer....

Overview Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data. Description Metal Gear Online 3 is...

VU #874418: RDK-B WebUI contains multiple vulnerabilitiesOverview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone...
08/29/2026

VU #874418: RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code ex*****on. Description RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI. CVE-2026-19505JWT (JSON Web Token) authentication in javascript-templates/source/jst_functions.c does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's EVP_VerifyFinal() function. A remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device. CVE-2026-19506 The login process in /usr/www2/check.jst uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session. An unauthenticated attacker can send a login request at the same time a legitimate administrator logs in. If the requests are timed correctly, the attacker's session may receive the administrator's successful authentication result, allowing access to the WebUI without knowing the correct password. CVE-2026-19507 The login handler in /usr/www2/check.jst does not limit the length of the password submitted by a user. The application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt. A remote, unauthenticated attacker can submit very large password values to consume excessive CPU resources. Repeated requests can make the WebUI and related services slow or unresponsive, resulting in a denial-of-service condition. CVE-2026-19508 The data parser in javascript-templates/source/jst_post.c does not properly validate malformed input before processing it in memory. A remote, unauthenticated attacker can send a specially crafted request that causes the Duktape WebUI ( process to access or modify memory incorrectly. During data parser processing and later during Duktape memory cleanup, indicating that application memory can be corrupted. An attacker may be able to use this vulnerability to cause a denial-of-service and potentially execute arbitrary code, although code ex*****on has not been demonstrated. CVE-2026-19509 The ajaxSet_wireless_network_configuration.jst handler does not properly validate the ssid_number value before passing it to the RDK-B routing service. An authenticated administrator can supply an abnormally large value that causes memory corruption in the native rtrouted process. This condition can crash rtrouted and trigger an RBus service restart. Successful exploitation can cause a denial-of-service. Because the flaw results in native memory corruption, arbitrary code ex*****on may also be possible. Impact A remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service. An authenticated administrator may be able to trigger memory corruption in the privileged rtrouted process and result in arbitrary code ex*****on. Successful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially ex*****on of attacker-controlled code on an affected device. Solution Unfortunately, RDK Central was unreachable to coordinate these vulnerabilities. Until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks. Acknowledgements Thanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities. This document was written by Michael Bragg....

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obta...

VU #431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacksOverview T...
08/29/2026

VU #431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Overview Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations. These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories - TCGVRT010 and TCGVRT0011: Description Trusted Platform Module (TPM) technology provides hardware-backed cryptographic services for modern computing platforms. TPMs are designed to resist tampering and may be implemented as discrete chips, integrated hardware, firmware-based TPMs (fTPMs), or software implementations used in cloud and virtualized environments. The Trusted Computing Group (TCG) maintains the TPM specifications and publishes a reference implementation to assist vendors in developing TPM-compliant products. Two vulnerabilities were identified in the TPM 2.0 reference implementation. CVE-2026-6727 A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. CVE-2026-6726 An information leakage vulnerability could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key, such as an Attestation Key (AK), DevID key, or TLS authentication key. This could enable the creation of fraudulent TPM 2.0 attestations using the forged key. Both vulnerabilities require privileged access to the TPM command interface. Multiple vendors have released firmware and software updates incorporating fixes from the updated TPM 2.0 reference implementation. Impact Successful exploitation requires privileged local access to a TPM command interface. Depending on the vulnerability exploited, an attacker may be able to: - Decrypt ciphertexts encrypted to the TPM-managed RS keys, including the RSA Endorsement Key (EK), , including credential blobs, import blobs, and session salts. - Obtain credentials for falsified TPM keys. - Produce fraudulent TPM 2.0 attestations that appear to originate from a legitimate TPM. The overall impact depends on the affected TPM implementation and how TPM-based attestation and key management are used by the platform. Solution The vulnerabilities originate in the TPM 2.0 reference implementation, and TPM vendors have incorporated the corresponding fixes into updated firmware and software releases. Users should install TPM firmware updates, operating system updates, or software patches provided by their platform or TPM vendor. Cloud providers using software-based TPM implementations may also have deployed updates. Customers should consult their cloud provider's guidance to determine whether any additional action is required. See the Vendor Information section for product-specific remediation guidance. Acknowledgements Thanks to security researchers Liran Perez, Zecharye Galitzky, Shai Sarfati, and Yanai Moyal from Intel for reporting these vulnerabilities. Thanks to members of the Trusted Computing Group’s Vulnerability Response Team, TCG VRT, for working with CERT/CC towards this multi-party vulnerability disclosure. This document was written by Vijay Sarvepalli....

Overview Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a TPM...

VU #308749: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura ServersOverview The Kaltura HTML5 P...
08/29/2026

VU #308749: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code ex*****on. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Notably, only versions of the legacy player (Player V2) are vulnerable; these issues do not affect any versions of the currently supported Kaltura Player V7. Description Kaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the mwEmbedLoader.php endpoint, which accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests. The KalturaClientBase PHP client library fetches data from this URL and automatically deserializes it using PHP's unserialize() function without validating source, scheme, or content. CVE-2026-19913 results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to ServiceUrl as a file:// path, and the client will fetch the internal file's contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user. CVE-2026-19912 is caused by insufficient sanitization of the parameter uiconf_id, which is appended to the base cache folder path when the application writes data to disk. Because this value is user-controlled and unsanitized, an attacker can supply values that include directory traversal sequences such as ../ to redirect file writes outside the intended cache directory. When the deployment uses the default file-based cache backend, an attacker can direct ServiceUrl to a malicious serialized object containing executable PHP code, then supply a uiconf_id path value that writes its deserialized fields to a web-accessible directory. The attacker can then request the file directly to achieve remote code ex*****on as the web-server user. A memcache-only backend may suppress the file write and prevent this specific code-ex*****on path, but the underlying unsafe deserialization behavior and unsanitized path construction remain present. Impact These vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or Kaltura session token is required to exploit either issue; an attacker only needs network access to the affected html5lib endpoint. CVE-2026-19913 can be abused to obtain database credentials, administrative secrets, API keys, or any other sensitive information hosted on the affected instance. Remote code ex*****on achieved through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts. Solution Kaltura has released new patches to remediate these vulnerabilities in all affected legacy Player V2 versions. Customers using legacy players, including self-hosted legacy player deployments (html5lib v2.x), should update to the patched version or, preferably, migrate to the newer and currently supported Kaltura Player V7 platform. Until the update is applied, users are advised to restrict or disable access to the mwEmbedLoader.php endpoint. Acknowledgements Thanks to Gerjan Wemekamp (AndDone) for researching and reporting these vulnerabilities. This document was written by Molly Jaconski....

Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code ex*****on. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that...

VU #308749: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura ServersOverview The Kaltura HTML5 P...
08/28/2026

VU #308749: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code ex*****on. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Notably, only versions of the legacy player (Player V2) are vulnerable; these issues do not affect any versions of the currently supported Kaltura Player V7. Description Kaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the mwEmbedLoader.php endpoint, which accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests. The KalturaClientBase PHP client library fetches data from this URL and automatically deserializes it using PHP's unserialize() function without validating source, scheme, or content. CVE-2026-19913 results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to ServiceUrl as a file:// path, and the client will fetch the internal file's contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user. CVE-2026-19912 is caused by insufficient sanitization of the parameter uiconf_id, which is appended to the base cache folder path when the application writes data to disk. Because this value is user-controlled and unsanitized, an attacker can supply values that include directory traversal sequences such as ../ to redirect file writes outside the intended cache directory. When the deployment uses the default file-based cache backend, an attacker can direct ServiceUrl to a malicious serialized object containing executable PHP code, then supply a uiconf_id path value that writes its deserialized fields to a web-accessible directory. The attacker can then request the file directly to achieve remote code ex*****on as the web-server user. A memcache-only backend may suppress the file write and prevent this specific code-ex*****on path, but the underlying unsafe deserialization behavior and unsanitized path construction remain present. Impact These vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or Kaltura session token is required to exploit either issue; an attacker only needs network access to the affected html5lib endpoint. CVE-2026-19913 can be abused to obtain database credentials, administrative secrets, API keys, or any other sensitive information hosted on the affected instance. Remote code ex*****on achieved through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts. Solution Kaltura has released new patches to remediate these vulnerabilities in all affected legacy Player V2 versions. Customers using legacy players, including self-hosted legacy player deployments (html5lib v2.x), should update to the patched version or, preferably, migrate to the newer and currently supported Kaltura Player V7 platform. Until the update is applied, users are advised to restrict or disable access to the mwEmbedLoader.php endpoint. Acknowledgements Thanks to Gerjan Wemekamp (AndDone) for researching and reporting these vulnerabilities. This document was written by Molly Jaconski.

Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code ex*****on. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that...

Address

669 Palmetto Avenue Suit E
Chico, CA
95926

Opening Hours

Monday 8am - 5pm
Tuesday 8am - 5pm
Wednesday 8am - 5pm
Thursday 8am - 5pm
Friday 8am - 5pm

Telephone

+15308918555

Website

Alerts

Be the first to know and let us send you an email when Vista Net, Inc. posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Vista Net, Inc.:

Shortcuts

Share

Category