Background CVE-2025-11837 affects QNAP Malware Remover. It carries a CVSS 9.8 score and is tagged as network-reachable, no authentication required, no user interaction. The vulnerability was first...
背景 CVE-2025-11837 是一个影响 QNAP Malware Remover 的漏洞，CVSS 9.8，标注为网络可达、无需认证、无需用户交互。该漏洞最早在 Pwn2Own Ireland 2025 上被演示，QNAP 随后在 QSA-25-47 公告中修复，修复版本为 Malware Remover 6.6.8.20251023。公告中的技术信息仅有 CWE-94（代码注入）...
How firmware reverse engineering revealed a hardcoded AES-256-CBC passphrase shared across all FortiSandbox devices — and why the 4.4.9 patch did nothing to fix it Background In our previous art...
通过固件逆向提取 FortiSandbox 备份加密的硬编码密码，还原完整的备份解密攻击链 背景 在上一篇文章中，我们分析了 CVE-2026-39813（JRPC 路径遍历认证绕过），发现攻击者可以通过 backup/config 端点未授权下载 32KB 的加密系统备份。该备份以 OpenSSL Salted__ 格式存储，使用 AES-256-CBC 加密。当时我们提到如果能获取...
Background On April 14, 2026, Fortinet published security advisory FG-IR-26-112 disclosing a critical path traversal vulnerability in FortiSandbox — CVE-2026-39813 (CVSS 9.1). The vulnerability af...