جزئیات آسیبپذیری
CVE-2026-105133
بهرهبرداری فعال
Ahsay AhsayCBS
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
CVSS 4.0
6.9متوسط
شرح رسمی (انگلیسی)
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 6.9متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A |
| 7.3بالا | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C |
| 7.3بالا | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C |
| 7.5بالا | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| Ahsay | AhsayCBS | 10.3.4.0 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.1 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.10 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.11 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.12 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.13 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.14 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.15 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.16 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.17 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.18 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.19 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.2 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.20 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.21 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.22 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.23 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.24 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.25 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.26 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.27 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.28 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.29 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.3 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.30 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.31 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.32 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.33 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.34 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.35 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.36 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.37 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.38 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.39 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.4 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.40 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.41 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.42 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.43 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.44 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.5 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.6 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.7 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.8 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.9 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.0 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.1 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.10 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.11 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.12 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.13 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.14 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.15 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.16 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.17 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.18 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.19 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.2 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.20 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.21 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.22 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.23 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.24 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.25 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.26 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.27 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.28 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.29 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.3 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.30 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.31 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.32 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.33 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.34 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.35 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.36 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.37 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.38 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.39 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.4 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.40 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.41 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.42 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.43 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.44 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.45 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.46 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.47 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.48 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.49 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.5 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.50 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.51 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.52 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.53 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.54 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.55 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.56 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.57 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.58 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.59 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.6 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.60 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.61 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.62 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.63 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.64 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.65 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.66 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.67 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.68 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.69 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.7 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.8 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۷- https://vuldb.com/vuln/413350 vdb-entrytechnical-description
- https://vuldb.com/vuln/413350/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-105133 third-party-advisory
- https://vuldb.com/submit/942688 third-party-advisory
- https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update patch
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit broken-linkexploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133 government-resource
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۷/۱۲
- آخرین بهروزرسانی
- ۱۴۰۵/۰۸/۰۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- VulDB
فهرست KEV آژانس CISA
- تاریخ افزودهشدن
- ۱۴۰۵/۰۷/۲۲
- مهلت رفع
- ۱۴۰۵/۰۷/۲۵
- استفاده در باجافزار
- نامشخص
پیشبینی بهرهبرداری (EPSS)
۷۹٫۴۷٪
احتمال بهرهبرداری در ۳۰ روز
۹۹٫۶٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهرهبرداری
- فعال
- اثر فنی
- جزئی
ضعفها (CWE)
- CWE-287Improper Authentication