{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2025-32432", "aliases": [], "title": "cms：コード実行", "summary": "Craft CMSは、バージョン3.0.0‑RC1以降3.9.15未満、4.0.0‑RC1以降4.14.15未満、5.0.0‑RC1以降5.6.17未満の間に、リモートからコードを実行させる脆弱性が存在します。この脆弱性は攻撃の複雑さが低く、影響度が高いです。上記の各バージョンは、CVE‑2023‑41892の修正に加えて、バージョン3.9.15、4.14.15、5.6.17で修正されています。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "product": "cms", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "affected": [ { "product": "cms", "range": ">= 3.0.0-RC1, < 3.9.15" }, { "product": "cms", "range": ">= 4.0.0-RC1, < 4.14.15" }, { "product": "cms", "range": ">= 5.0.0-RC1, < 5.6.17" } ], "fixed": [], "steps": [ "上記の各バージョンは、CVE‑2023‑41892の修正に加えて、バージョン3.9.15、4.14.15、5.6.17で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-32432", "label": "CVE公式レコード" }, { "url": "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "label": "CISAが示す関連情報" }, { "url": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "label": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47" }, { "url": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical" }, { "url": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical" }, { "url": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical" }, { "url": "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32432", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-25T15:04:06.272Z", "modifiedAt": "2026-03-21T04:00:57.147Z", "fetchedAt": "2026-10-23T02:43:37.663Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.", "sourceTitle": "Craft CMS Allows Remote Code Execution", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "craftcms", "product": "cms", "versions": [ { "version": ">= 3.0.0-RC1, < 3.9.15", "status": "affected" }, { "version": ">= 4.0.0-RC1, < 4.14.15", "status": "affected" }, { "version": ">= 5.0.0-RC1, < 5.6.17", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-32432", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "fetchedAt": "2026-10-23T02:43:37.663Z", "publishedAt": "2025-04-25T15:04:06.272Z", "modifiedAt": "2026-03-21T04:00:57.147Z", "state": "published", "provider": "GitHub_M", "title": "Craft CMS Allows Remote Code Execution", "descriptions": [ { "lang": "en", "value": "Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "craftcms", "product": "cms", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">= 3.0.0-RC1, < 3.9.15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": ">= 4.0.0-RC1, < 4.14.15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": ">= 5.0.0-RC1, < 5.6.17", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "label": "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "label": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/4" }, { "url": "https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/", "label": "CISA-ADP", "tags": [ "technical-description", "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32432", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"craftcms\",\"product\":\"cms\",\"versions\":[{\"version\":\">= 3.0.0-RC1, < 3.9.15\",\"status\":\"affected\"},{\"version\":\">= 4.0.0-RC1, < 4.14.15\",\"status\":\"affected\"},{\"version\":\">= 5.0.0-RC1, < 5.6.17\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-94\",\"lang\":\"en\",\"description\":\"CWE-94: Improper Control of Generation of Code ('Code Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-21T04:00:57.147Z", "fetchedAt": "2026-10-23T02:43:37.663Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "cmsにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:29.362Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "de598babe6d066cd0813d2795769d18eb539bba0be0e7e216b9c658404ce7c53", "sourceModifiedAt": "2026-03-21T04:00:57.147Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Craft CMSは、バージョン3.0.0‑RC1以降3.9.15未満、4.0.0‑RC1以降4.14.15未満、5.0.0‑RC1以降5.6.17未満の間に、リモートからコードを実行させる脆弱性が存在します。この脆弱性は攻撃の複雑さが低く、影響度が高いです。上記の各バージョンは、CVE‑2023‑41892の修正に加えて、バージョン3.9.15、4.14.15、5.6.17で修正されています。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "Craft CMS バージョン3.0.0‑RC1 以上、3.9.15 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Craft CMS バージョン4.0.0‑RC1 以上、4.14.15 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Craft CMS バージョン5.0.0‑RC1 以上、5.6.17 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：craftcms / cms。影響ありとして記載：>= 3.0.0-RC1, < 3.9.15。影響ありとして記載：>= 4.0.0-RC1, < 4.14.15。影響ありとして記載：>= 5.0.0-RC1, < 5.6.17。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4" ] }, { "text": "「cms」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-32432", "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432", "https://nvd.nist.gov/vuln/detail/CVE-2025-32432" ] } ], "actions": [ { "text": "上記の各バージョンは、CVE‑2023‑41892の修正に加えて、バージョン3.9.15、4.14.15、5.6.17で修正されています。", "kind": "fix", "evidenceIds": [ "E1", "E2" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-32432", "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432", "https://nvd.nist.gov/vuln/detail/CVE-2025-32432" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-32432", "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432", "https://nvd.nist.gov/vuln/detail/CVE-2025-32432" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-32432", "label": "CVE公式レコード" }, { "url": "https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3", "label": "CISAが示す関連情報" }, { "url": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47", "label": "https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47" }, { "url": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical" }, { "url": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical" }, { "url": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical", "label": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical" }, { "url": "https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32432", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourceField": "/containers/cna/title", "excerpt": "Craft CMS Allows Remote Code Execution", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"cweId\":\"CWE-94\",\"lang\":\"en\",\"description\":\"CWE-94: Improper Control of Generation of Code ('Code Injection')\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/32xxx/CVE-2025-32432.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"craftcms\",\"product\":\"cms\",\"versions\":[{\"version\":\">= 3.0.0-RC1, < 3.9.15\",\"status\":\"affected\"},{\"version\":\">= 4.0.0-RC1, < 4.14.15\",\"status\":\"affected\"},{\"version\":\">= 5.0.0-RC1, < 5.6.17\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32432", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-32432\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-32432（cms）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Craft CMS バージョン3.0.0‑RC1 以上、3.9.15 未満は影響を受けます。\n・Craft CMS バージョン4.0.0‑RC1 以上、4.14.15 未満は影響を受けます。\n・Craft CMS バージョン5.0.0‑RC1 以上、5.6.17 未満は影響を受けます。\n・公式の対象表：craftcms / cms。影響ありとして記載：>= 3.0.0-RC1, < 3.9.15。影響ありとして記載：>= 4.0.0-RC1, < 4.14.15。影響ありとして記載：>= 5.0.0-RC1, < 5.6.17。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-32432", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:29.362Z", "lastSuccess": "2026-10-23T03:24:29.362Z", "sourceCheckedAt": "2026-10-23T02:43:37.663Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-43510", "aliases": [], "title": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS：脆弱性情報", "summary": "メモリ破損の問題が、ロック状態のチェックを改善することで修正されました。この問題は iOS 18.7.2、iPadOS 18.7.2、iOS 26.1、iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。悪意のあるアプリがプロセス間で共有されているメモリを予期せぬ形で変更させる可能性があります。", "risk": "悪意のあるアプリがプロセス間で共有されているメモリを予期せぬ形で変更させる可能性があります。", "product": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": "< 18.7.2" }, { "product": "iOS and iPadOS", "range": "< 26.1" }, { "product": "macOS", "range": "< 14.8.2" }, { "product": "macOS", "range": "< 15.7.2" }, { "product": "macOS", "range": "< 26.1" }, { "product": "tvOS", "range": "< 26.1" }, { "product": "visionOS", "range": "< 26.1" }, { "product": "watchOS", "range": "< 26.1" } ], "fixed": [], "steps": [ "この問題は iOS 18.7.2、iPadOS 18.7.2、iOS 26.1、iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-43510", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/125632", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125633", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125634", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125635", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125636", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125637", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125638", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125639", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-12T20:56:38.131Z", "modifiedAt": "2026-04-02T18:16:23.175Z", "fetchedAt": "2026-10-23T02:43:38.387Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.7.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.8.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "15.7.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-43510", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "fetchedAt": "2026-10-23T02:43:38.387Z", "publishedAt": "2025-12-12T20:56:38.131Z", "modifiedAt": "2026-04-02T18:16:23.175Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "18.7.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "14.8.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "15.7.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "A malicious application may cause unexpected changes in memory shared between processes", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/125632", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/125633", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/125634", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/125635", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://support.apple.com/en-us/125636", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/4" }, { "url": "https://support.apple.com/en-us/125637", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/5" }, { "url": "https://support.apple.com/en-us/125638", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/6" }, { "url": "https://support.apple.com/en-us/125639", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/7" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"14.8.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"A malicious application may cause unexpected changes in memory shared between processes\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-02T18:16:23.175Z", "fetchedAt": "2026-10-23T02:43:38.387Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOS / macOS / tvOS / visionOS / watchOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:29.428Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b65e44eab3b7c1bd2b3cc2f2e5c7985f83b679e2bb270d08615429c031883cb9", "sourceModifiedAt": "2026-04-02T18:16:23.175Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ破損の問題が、ロック状態のチェックを改善することで修正されました。この問題は iOS 18.7.2、iPadOS 18.7.2、iOS 26.1、iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。悪意のあるアプリがプロセス間で共有されているメモリを予期せぬ形で変更させる可能性があります。", "risk": "悪意のあるアプリがプロセス間で共有されているメモリを予期せぬ形で変更させる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "iOS および iPadOS のバージョンが 18.7.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] }, { "text": "iOS および iPadOS のバージョンが 26.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] }, { "text": "macOS のバージョンが 14.8.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E4" ] }, { "text": "macOS のバージョンが 15.7.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E4" ] }, { "text": "macOS のバージョンが 26.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E4" ] }, { "text": "tvOS のバージョンが 26.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E5" ] }, { "text": "visionOS のバージョンが 26.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E6" ] }, { "text": "watchOS のバージョンが 26.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.7.2未満の版。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：14.8.2未満の版。影響ありとして記載：15.7.2未満の版。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] }, { "text": "「iOS and iPadOS / macOS / tvOS / visionOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-43510", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510" ] } ], "actions": [ { "text": "この問題は iOS 18.7.2、iPadOS 18.7.2、iOS 26.1、iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-43510", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-43510", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-43510", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/125632", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125633", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125634", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125635", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125636", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125637", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125638", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125639", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"A malicious application may cause unexpected changes in memory shared between processes\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"14.8.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43510.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43510", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-43510\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-43510（iOS and iPadOS / macOS / tvOS / visionOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・iOS および iPadOS のバージョンが 18.7.2 未満は影響を受けます。\n・iOS および iPadOS のバージョンが 26.1 未満は影響を受けます。\n・macOS のバージョンが 14.8.2 未満は影響を受けます。\n・macOS のバージョンが 15.7.2 未満は影響を受けます。\n・macOS のバージョンが 26.1 未満は影響を受けます。\n・tvOS のバージョンが 26.1 未満は影響を受けます。\n・visionOS のバージョンが 26.1 未満は影響を受けます。\n・watchOS のバージョンが 26.1 未満は影響を受けます。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.7.2未満の版。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：14.8.2未満の版。影響ありとして記載：15.7.2未満の版。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / tvOS。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / watchOS。影響ありとして記載：26.1未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-43510", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:29.428Z", "lastSuccess": "2026-10-23T03:24:29.428Z", "sourceCheckedAt": "2026-10-23T02:43:38.387Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-43520", "aliases": [], "title": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS：脆弱性情報", "summary": "メモリ破損の問題が、メモリ処理の改善により対処されました。この問題は iOS 18.7.2 と iPadOS 18.7.2、iOS 26.1 と iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。悪意のあるアプリケーションは、システムの予期しない終了やカーネルメモリへの書き込みを引き起こす可能性があります。", "risk": "悪意のあるアプリケーションにより、システムが予期せず終了したり、カーネルメモリが書き換えられる可能性があります。", "product": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": "< 18.7.2" }, { "product": "iOS and iPadOS", "range": "< 26.1" }, { "product": "macOS", "range": "< 14.8.2" }, { "product": "macOS", "range": "< 15.7.2" }, { "product": "macOS", "range": "< 26.1" }, { "product": "tvOS", "range": "< 26.1" }, { "product": "visionOS", "range": "< 26.1" }, { "product": "watchOS", "range": "< 26.1" } ], "fixed": [], "steps": [ "この問題は iOS 18.7.2 と iPadOS 18.7.2、iOS 26.1 と iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-43520", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/125632", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125633", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125634", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125635", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125636", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125637", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125638", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125639", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-12T20:56:25.542Z", "modifiedAt": "2026-09-21T16:47:43.935Z", "fetchedAt": "2026-10-23T02:43:38.418Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.7.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.8.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "15.7.2", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-43520", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "fetchedAt": "2026-10-23T02:43:38.418Z", "publishedAt": "2025-12-12T20:56:25.542Z", "modifiedAt": "2026-09-21T16:47:43.935Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "18.7.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "14.8.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "15.7.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "0", "lessThan": "26.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "A malicious application may be able to cause unexpected system termination or write kernel memory", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/125632", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/125633", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/125634", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/125635", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://support.apple.com/en-us/125636", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/4" }, { "url": "https://support.apple.com/en-us/125637", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/5" }, { "url": "https://support.apple.com/en-us/125638", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/6" }, { "url": "https://support.apple.com/en-us/125639", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/7" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"14.8.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"A malicious application may be able to cause unexpected system termination or write kernel memory\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":5.5,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T16:47:43.935Z", "fetchedAt": "2026-10-23T02:43:38.418Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOS / macOS / tvOS / visionOS / watchOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:29.745Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7319ece773bb9e7dc24b130672329b5fc8cd367a24acc53257d6c50cf9a4591d", "sourceModifiedAt": "2026-09-21T16:47:43.935Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ破損の問題が、メモリ処理の改善により対処されました。この問題は iOS 18.7.2 と iPadOS 18.7.2、iOS 26.1 と iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。悪意のあるアプリケーションは、システムの予期しない終了やカーネルメモリへの書き込みを引き起こす可能性があります。", "risk": "悪意のあるアプリケーションにより、システムが予期せず終了したり、カーネルメモリが書き換えられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "iOS と iPadOS はバージョン 18.7.2 未満および 26.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E3" ] }, { "text": "macOS はバージョン 14.8.2 未満、15.7.2 未満、26.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E4" ] }, { "text": "tvOS はバージョン 26.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E5" ] }, { "text": "visionOS はバージョン 26.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E6" ] }, { "text": "watchOS はバージョン 26.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.7.2未満の版。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：14.8.2未満の版。影響ありとして記載：15.7.2未満の版。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：26.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E3" ] }, { "text": "「iOS and iPadOS / macOS / tvOS / visionOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-43520", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520" ] } ], "actions": [ { "text": "この問題は iOS 18.7.2 と iPadOS 18.7.2、iOS 26.1 と iPadOS 26.1、macOS Sequoia 15.7.2、macOS Sonoma 14.8.2、macOS Tahoe 26.1、tvOS 26.1、visionOS 26.1、watchOS 26.1 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-43520", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-43520", "https://support.apple.com/en-us/125632", "https://support.apple.com/en-us/125633", "https://support.apple.com/en-us/125634", "https://support.apple.com/en-us/125635", "https://support.apple.com/en-us/125636", "https://support.apple.com/en-us/125637", "https://support.apple.com/en-us/125638", "https://support.apple.com/en-us/125639", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-43520", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/125632", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125633", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125634", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125635", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125636", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/125637", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125638", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/125639", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"A malicious application may be able to cause unexpected system termination or write kernel memory\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"14.8.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.7.2\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/43xxx/CVE-2025-43520.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43520", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-43520\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-43520（iOS and iPadOS / macOS / tvOS / visionOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・iOS と iPadOS はバージョン 18.7.2 未満および 26.1 未満が影響を受けます。\n・macOS はバージョン 14.8.2 未満、15.7.2 未満、26.1 未満が影響を受けます。\n・tvOS はバージョン 26.1 未満が影響を受けます。\n・visionOS はバージョン 26.1 未満が影響を受けます。\n・watchOS はバージョン 26.1 未満が影響を受けます。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.7.2未満の版。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：14.8.2未満の版。影響ありとして記載：15.7.2未満の版。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / tvOS。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：26.1未満の版。\n・公式の対象表：Apple / watchOS。影響ありとして記載：26.1未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-43520", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:29.745Z", "lastSuccess": "2026-10-23T03:24:29.745Z", "sourceCheckedAt": "2026-10-23T02:43:38.418Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-54068", "aliases": [], "title": "livewire：脆弱性情報", "summary": "Livewire はプロパティ更新のハイドレーション中にリモートコマンド実行が可能になる脆弱性があります。Livewire v3（3.0.0‑beta.1 以上、3.6.3 以下）において、認証されていない攻撃者が特定のシナリオでサーバー上の任意のコマンドを実行できる可能性があります。攻撃にはコンポーネントがマウントされ、特定の方法で設定されていることが条件ですが、認証やユーザー操作は不要です。この問題は Livewire v3.6.4 で修正されており、できるだけ早く当該バージョン以降にアップグレードすることが強く推奨されます。既知の回避策はありません。", "risk": "攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。", "product": "livewire", "category": "other", "component": "package", "severity": "critical", "cvss": 9.2, "cvssVersion": "4.0", "cvssSource": "GitHub_M", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "livewire", "range": ">= 3.0.0-beta.1, < 3.6.4" } ], "fixed": [], "steps": [ "Livewire v3.6.4 以降のバージョンにアップグレードしてください。", "「CVE-2025-54068」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-54068", "label": "CVE公式レコード" }, { "url": "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "label": "CISAが示す関連情報" }, { "url": "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/livewire/livewire/releases/tag/v3.6.4", "label": "https://github.com/livewire/livewire/releases/tag/v3.6.4" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54068", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-17T18:16:56.099Z", "modifiedAt": "2026-03-23T13:04:50.156Z", "fetchedAt": "2026-10-23T02:43:39.186Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.", "sourceTitle": "Livewire vulnerable to remote command execution during property update hydration", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "livewire", "product": "livewire", "versions": [ { "version": ">= 3.0.0-beta.1, < 3.6.4", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-54068", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "fetchedAt": "2026-10-23T02:43:39.186Z", "publishedAt": "2025-07-17T18:16:56.099Z", "modifiedAt": "2026-03-23T13:04:50.156Z", "state": "published", "provider": "GitHub_M", "title": "Livewire vulnerable to remote command execution during property update hydration", "descriptions": [ { "lang": "en", "value": "Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "livewire", "product": "livewire", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">= 3.0.0-beta.1, < 3.6.4", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "label": "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "label": "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/livewire/livewire/releases/tag/v3.6.4", "label": "https://github.com/livewire/livewire/releases/tag/v3.6.4", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"livewire\",\"product\":\"livewire\",\"versions\":[{\"version\":\">= 3.0.0-beta.1, < 3.6.4\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-94\",\"lang\":\"en\",\"description\":\"CWE-94: Improper Control of Generation of Code ('Code Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-23T13:04:50.156Z", "fetchedAt": "2026-10-23T02:43:39.186Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "livewireに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:31.763Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0d228c5e8a6924d5b60dc016f9f979e8bbb6118adaf1ebf4cb16730a92751e97", "sourceModifiedAt": "2026-03-23T13:04:50.156Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Livewire はプロパティ更新のハイドレーション中にリモートコマンド実行が可能になる脆弱性があります。Livewire v3（3.0.0‑beta.1 以上、3.6.3 以下）において、認証されていない攻撃者が特定のシナリオでサーバー上の任意のコマンドを実行できる可能性があります。攻撃にはコンポーネントがマウントされ、特定の方法で設定されていることが条件ですが、認証やユーザー操作は不要です。この問題は Livewire v3.6.4 で修正されており、できるだけ早く当該バージョン以降にアップグレードすることが強く推奨されます。既知の回避策はありません。", "risk": "攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Livewire v3 のバージョン 3.0.0‑beta.1 以上、3.6.3 以下が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "本脆弱性は Livewire のメジャー版 3 にのみ存在し、以前のメジャー版には影響しません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃を実行するには、コンポーネントがマウントされ、特定の方法で設定されている必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃には認証は不要で、ユーザーの操作も必要としません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：livewire / livewire。影響ありとして記載：>= 3.0.0-beta.1, < 3.6.4。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E3" ] }, { "text": "「livewire」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-54068", "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "https://github.com/livewire/livewire/releases/tag/v3.6.4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" ] } ], "actions": [ { "text": "Livewire v3.6.4 以降のバージョンにアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E2" ] }, { "text": "「CVE-2025-54068」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-54068", "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "https://github.com/livewire/livewire/releases/tag/v3.6.4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-54068", "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "https://github.com/livewire/livewire/releases/tag/v3.6.4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-54068", "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "https://github.com/livewire/livewire/releases/tag/v3.6.4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-54068", "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "https://github.com/livewire/livewire/releases/tag/v3.6.4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-54068", "label": "CVE公式レコード" }, { "url": "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3", "label": "CISAが示す関連情報" }, { "url": "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/livewire/livewire/releases/tag/v3.6.4", "label": "https://github.com/livewire/livewire/releases/tag/v3.6.4" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54068", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourceField": "/containers/cna/title", "excerpt": "Livewire vulnerable to remote command execution during property update hydration", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54068.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"livewire\",\"product\":\"livewire\",\"versions\":[{\"version\":\">= 3.0.0-beta.1, < 3.6.4\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54068", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-54068\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-54068（livewire）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Livewire v3 のバージョン 3.0.0‑beta.1 以上、3.6.3 以下が影響を受けます。\n・本脆弱性は Livewire のメジャー版 3 にのみ存在し、以前のメジャー版には影響しません。\n・攻撃を実行するには、コンポーネントがマウントされ、特定の方法で設定されている必要があります。\n・攻撃には認証は不要で、ユーザーの操作も必要としません。\n・公式の対象表：livewire / livewire。影響ありとして記載：>= 3.0.0-beta.1, < 3.6.4。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-54068", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:31.763Z", "lastSuccess": "2026-10-23T03:24:31.763Z", "sourceCheckedAt": "2026-10-23T02:43:39.186Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20131", "aliases": [], "title": "Cisco Secure Firewall Management Center (FMC)：コード実行", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブベース管理インターフェイスに脆弱性があり、認証されていないリモート攻撃者が細工した Java オブジェクトを送信することで、対象デバイス上で任意の Java コードを root 権限で実行できる可能性があります。この脆弱性は、ユーザーが提供した Java バイトストリームの安全でない逆シリアライズが原因です。FMC の管理インターフェイスがインターネットに公開されていない場合、攻撃対象となる範囲は縮小します。", "risk": "攻撃者がデバイス上で任意のコードを root 権限で実行できるため、システム全体が完全に制御される危険があります。", "product": "Cisco Secure Firewall Management Center (FMC)", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.13" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.14" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.15" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.16" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.17" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "6.4.0.18" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.9" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.11" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "10.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20131", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20131", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-03-04T17:17:56.008Z", "modifiedAt": "2026-08-14T03:55:24.856Z", "fetchedAt": "2026-10-23T02:43:47.286Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.", "sourceTitle": "Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "versions": [ { "version": "7.0.0", "status": "affected" }, { "version": "7.0.0.1", "status": "affected" }, { "version": "7.0.1", "status": "affected" }, { "version": "7.1.0", "status": "affected" }, { "version": "6.4.0.13", "status": "affected" }, { "version": "7.0.1.1", "status": "affected" }, { "version": "6.4.0.14", "status": "affected" }, { "version": "7.1.0.1", "status": "affected" }, { "version": "7.0.2", "status": "affected" }, { "version": "6.4.0.15", "status": "affected" }, { "version": "7.2.0", "status": "affected" }, { "version": "7.0.2.1", "status": "affected" }, { "version": "7.0.3", "status": "affected" }, { "version": "7.1.0.2", "status": "affected" }, { "version": "7.2.0.1", "status": "affected" }, { "version": "7.0.4", "status": "affected" }, { "version": "7.2.1", "status": "affected" }, { "version": "7.0.5", "status": "affected" }, { "version": "6.4.0.16", "status": "affected" }, { "version": "7.3.0", "status": "affected" }, { "version": "7.2.2", "status": "affected" }, { "version": "7.3.1", "status": "affected" }, { "version": "7.2.3", "status": "affected" }, { "version": "7.1.0.3", "status": "affected" }, { "version": "7.2.3.1", "status": "affected" }, { "version": "7.2.4", "status": "affected" }, { "version": "7.0.6", "status": "affected" }, { "version": "7.2.4.1", "status": "affected" }, { "version": "7.2.5", "status": "affected" }, { "version": "7.3.1.1", "status": "affected" }, { "version": "7.4.0", "status": "affected" }, { "version": "6.4.0.17", "status": "affected" }, { "version": "7.0.6.1", "status": "affected" }, { "version": "7.2.5.1", "status": "affected" }, { "version": "7.4.1", "status": "affected" }, { "version": "7.2.6", "status": "affected" }, { "version": "7.4.1.1", "status": "affected" }, { "version": "7.0.6.2", "status": "affected" }, { "version": "6.4.0.18", "status": "affected" }, { "version": "7.2.7", "status": "affected" }, { "version": "7.2.5.2", "status": "affected" }, { "version": "7.3.1.2", "status": "affected" }, { "version": "7.2.8", "status": "affected" }, { "version": "7.6.0", "status": "affected" }, { "version": "7.4.2", "status": "affected" }, { "version": "7.2.8.1", "status": "affected" }, { "version": "7.0.6.3", "status": "affected" }, { "version": "7.4.2.1", "status": "affected" }, { "version": "7.2.9", "status": "affected" }, { "version": "7.0.7", "status": "affected" }, { "version": "7.7.0", "status": "affected" }, { "version": "7.4.2.2", "status": "affected" }, { "version": "7.2.10", "status": "affected" }, { "version": "7.6.1", "status": "affected" }, { "version": "7.4.2.3", "status": "affected" }, { "version": "7.0.8", "status": "affected" }, { "version": "7.6.2", "status": "affected" }, { "version": "7.7.10", "status": "affected" }, { "version": "7.2.10.1", "status": "affected" }, { "version": "7.0.8.1", "status": "affected" }, { "version": "7.6.2.1", "status": "affected" }, { "version": "7.2.10.2", "status": "affected" }, { "version": "7.7.10.1", "status": "affected" }, { "version": "7.4.2.4", "status": "affected" }, { "version": "7.4.3", "status": "affected" }, { "version": "7.7.11", "status": "affected" }, { "version": "7.6.4", "status": "affected" }, { "version": "10.0.0", "status": "affected" }, { "version": "7.4.4", "status": "affected" }, { "version": "7.4.5", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20131", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "fetchedAt": "2026-10-23T02:43:47.286Z", "publishedAt": "2026-03-04T17:17:56.008Z", "modifiedAt": "2026-08-14T03:55:24.856Z", "state": "published", "provider": "cisco", "title": "Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "6.4.0.13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "7.0.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "6.4.0.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "7.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "7.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "6.4.0.15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "7.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "7.0.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "7.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "7.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "7.2.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "7.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "7.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "7.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "6.4.0.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "7.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "7.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "7.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "7.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "7.1.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "7.2.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "7.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "7.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "7.2.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "7.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "7.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "7.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "6.4.0.17", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "7.0.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "7.2.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "7.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "7.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "7.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "7.0.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "6.4.0.18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "7.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "7.2.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "7.3.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "7.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "7.6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "7.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "7.2.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "7.0.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "7.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "7.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "7.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "7.7.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "7.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "7.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "7.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "7.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "7.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "7.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "7.7.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "7.2.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "7.0.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "7.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "7.2.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "7.7.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "7.4.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "7.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "7.7.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "7.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "10.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "7.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "7.4.5", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In March 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "label": "cisco-sa-fmc-rce-NKhnULJh", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"status\":\"affected\"},{\"version\":\"6.4.0.13\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"6.4.0.14\",\"status\":\"affected\"},{\"version\":\"7.1.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"6.4.0.15\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"6.4.0.16\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"6.4.0.17\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"6.4.0.18\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In March 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Deserialization of Untrusted Data\",\"type\":\"cwe\",\"cweId\":\"CWE-502\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-14T03:55:24.856Z", "fetchedAt": "2026-10-23T02:43:47.286Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-19T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Cisco Secure Firewall Management Center (FMC)にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:32.997Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f11171075b544769d1bdaf4deef442e34552767908aa1474a8cba32ff89963a4", "sourceModifiedAt": "2026-08-14T03:55:24.856Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブベース管理インターフェイスに脆弱性があり、認証されていないリモート攻撃者が細工した Java オブジェクトを送信することで、対象デバイス上で任意の Java コードを root 権限で実行できる可能性があります。この脆弱性は、ユーザーが提供した Java バイトストリームの安全でない逆シリアライズが原因です。FMC の管理インターフェイスがインターネットに公開されていない場合、攻撃対象となる範囲は縮小します。", "risk": "攻撃者がデバイス上で任意のコードを root 権限で実行できるため、システム全体が完全に制御される危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるバージョンは、7.0.0、7.0.0.1、7.0.1、7.1.0、6.4.0.13、7.0.1.1、6.4.0.14、7.1.0.1、7.0.2、6.4.0.15、7.2.0、7.0.2.1、7.0.3、7.1.0.2、7.2.0.1、7.0.4、7.2.1、7.0.5、6.4.0.16、7.3.0、7.2.2、7.3.1、7.2.3、7.1.0.3、7.2.3.1、7.2.4、7.0.6、7.2.4.1、7.2.5、7.3.1.1、7.4.0、6.4.0.17、7.0.6.1、7.2.5.1、7.4.1、7.2.6、7.4.1.1、7.0.6.2、6.4.0.18、7.2.7、7.2.5.2、7.3.1.2、7.2.8、7.6.0、7.4.2、7.2.8.1、7.0.6.3、7.4.2.1、7.2.9、7.0.7、7.7.0、7.4.2.2、7.2.10、7.6.1、7.4.2.3、7.0.8、7.6.2、7.7.10、7.2.10.1、7.0.8.1、7.6.2.1、7.2.10.2、7.7.10.1、7.4.2.4、7.4.3、7.7.11、7.6.4、10.0.0、7.4.4、7.4.5 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "FMC の管理インターフェイスがインターネットに公開されていない場合、攻撃対象となる範囲は縮小します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.1.0。影響ありとして記載：6.4.0.13。影響ありとして記載：7.0.1.1。影響ありとして記載：6.4.0.14。影響ありとして記載：7.1.0.1。影響ありとして記載：7.0.2。影響ありとして記載：6.4.0.15。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.1.0.2。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：6.4.0.16。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.1.0.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：6.4.0.17。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：6.4.0.18。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Secure Firewall Management Center (FMC)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20131", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "https://nvd.nist.gov/vuln/detail/CVE-2026-20131" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20131", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "https://nvd.nist.gov/vuln/detail/CVE-2026-20131" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20131", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "https://nvd.nist.gov/vuln/detail/CVE-2026-20131" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20131", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20131", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"status\":\"affected\"},{\"version\":\"6.4.0.13\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"6.4.0.14\",\"status\":\"affected\"},{\"version\":\"7.1.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"6.4.0.15\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"6.4.0.16\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"6.4.0.17\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"6.4.0.18\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20131", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20131\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20131（Cisco Secure Firewall Management Center (FMC)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるバージョンは、7.0.0、7.0.0.1、7.0.1、7.1.0、6.4.0.13、7.0.1.1、6.4.0.14、7.1.0.1、7.0.2、6.4.0.15、7.2.0、7.0.2.1、7.0.3、7.1.0.2、7.2.0.1、7.0.4、7.2.1、7.0.5、6.4.0.16、7.3.0、7.2.2、7.3.1、7.2.3、7.1.0.3、7.2.3.1、7.2.4、7.0.6、7.2.4.1、7.2.5、7.3.1.1、7.4.0、6.4.0.17、7.0.6.1、7.2.5.1、7.4.1、7.2.6、7.4.1.1、7.0.6.2、6.4.0.18、7.2.7、7.2.5.2、7.3.1.2、7.2.8、7.6.0、7.4.2、7.2.8.1、7.0.6.3、7.4.2.1、7.2.9、7.0.7、7.7.0、7.4.2.2、7.2.10、7.6.1、7.4.2.3、7.0.8、7.6.2、7.7.10、7.2.10.1、7.0.8.1、7.6.2.1、7.2.10.2、7.7.10.1、7.4.2.4、7.4.3、7.7.11、7.6.4、10.0.0、7.4.4、7.4.5 が影響を受けます。\n・FMC の管理インターフェイスがインターネットに公開されていない場合、攻撃対象となる範囲は縮小します。\n・公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.1.0。影響ありとして記載：6.4.0.13。影響ありとして記載：7.0.1.1。影響ありとして記載：6.4.0.14。影響ありとして記載：7.1.0.1。影響ありとして記載：7.0.2。影響ありとして記載：6.4.0.15。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.1.0.2。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：6.4.0.16。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.1.0.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：6.4.0.17。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：6.4.0.18。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20131", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:32.997Z", "lastSuccess": "2026-10-23T03:24:32.997Z", "sourceCheckedAt": "2026-10-23T02:43:47.286Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-66376", "aliases": [], "title": "Collaboration：ブラウザー上での不正な処理", "summary": "Zimbra Collaboration (ZCS) のバージョン10で、10.0.18 未満および 10.1.13 未満では、Classic UI において HTML メール本文に含まれる CSS の @import ディレクティブを利用した保存型 XSS が可能です。", "risk": "保存型 XSS が可能になる。", "product": "Collaboration", "category": "other", "component": "package", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Collaboration", "range": ">= 10.0 / < 10.0.18" }, { "product": "Collaboration", "range": ">= 10.1 / < 10.1.13" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-66376", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66376", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-05T00:00:00.000Z", "modifiedAt": "2026-03-19T03:55:17.926Z", "fetchedAt": "2026-10-23T02:43:40.134Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Collaboration", "vendor": "Zimbra", "versions": [ { "lessThan": "10.0.18", "status": "affected", "version": "10.0", "versionType": "custom" }, { "lessThan": "10.1.13", "status": "affected", "version": "10.1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-66376", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "fetchedAt": "2026-10-23T02:43:40.134Z", "publishedAt": "2026-01-05T00:00:00.000Z", "modifiedAt": "2026-03-19T03:55:17.926Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Zimbra", "product": "Collaboration", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0", "lessThan": "10.0.18", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "10.1", "lessThan": "10.1.13", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Collaboration\",\"vendor\":\"Zimbra\",\"versions\":[{\"lessThan\":\"10.0.18\",\"status\":\"affected\",\"version\":\"10.0\",\"versionType\":\"custom\"},{\"lessThan\":\"10.1.13\",\"status\":\"affected\",\"version\":\"10.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-79\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-19T03:55:17.926Z", "fetchedAt": "2026-10-23T02:43:40.134Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Collaborationにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:33.024Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "63fa91649cb058e487a89d93ff0a94b292a4e3ff3a5f7452cb0fc13d9ea0d5bd", "sourceModifiedAt": "2026-03-19T03:55:17.926Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zimbra Collaboration (ZCS) のバージョン10で、10.0.18 未満および 10.1.13 未満では、Classic UI において HTML メール本文に含まれる CSS の @import ディレクティブを利用した保存型 XSS が可能です。", "risk": "保存型 XSS が可能になる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Zimbra Collaboration (ZCS) バージョン 10.0 系で、10.0.18 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] }, { "text": "Zimbra Collaboration (ZCS) バージョン 10.1 系で、10.1.13 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Zimbra / Collaboration。影響ありとして記載：10.0以上、10.0.18未満。影響ありとして記載：10.1以上、10.1.13未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Collaboration」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-66376", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "https://nvd.nist.gov/vuln/detail/CVE-2025-66376" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-66376", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "https://nvd.nist.gov/vuln/detail/CVE-2025-66376" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-66376", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "https://nvd.nist.gov/vuln/detail/CVE-2025-66376" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-66376", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes", "label": "CVE掲載の参考情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66376", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/66xxx/CVE-2025-66376.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Collaboration\",\"vendor\":\"Zimbra\",\"versions\":[{\"lessThan\":\"10.0.18\",\"status\":\"affected\",\"version\":\"10.0\",\"versionType\":\"custom\"},{\"lessThan\":\"10.1.13\",\"status\":\"affected\",\"version\":\"10.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-66376", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-66376\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-66376（Collaboration）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Zimbra Collaboration (ZCS) バージョン 10.0 系で、10.0.18 未満は影響を受けます。\n・Zimbra Collaboration (ZCS) バージョン 10.1 系で、10.1.13 未満は影響を受けます。\n・公式の対象表：Zimbra / Collaboration。影響ありとして記載：10.0以上、10.0.18未満。影響ありとして記載：10.1以上、10.1.13未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-66376", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:33.024Z", "lastSuccess": "2026-10-23T03:24:33.024Z", "sourceCheckedAt": "2026-10-23T02:43:40.134Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-20963", "aliases": [], "title": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition：コード実行", "summary": "Microsoft Office SharePoint の信頼できないデータの逆シリアライズにより、認可されていない攻撃者がネットワーク越しにコードを実行できるリモートコード実行脆弱性です。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "product": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition", "category": "windows", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft SharePoint Enterprise Server 2016", "range": ">= 16.0.0 / < 16.0.5535.1001（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server 2019", "range": ">= 16.0.0 / < 16.0.10417.20083（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server Subscription Edition", "range": ">= 16.0.0 / < 16.0.19127.20442（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20963", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-13T17:56:49.798Z", "modifiedAt": "2026-07-30T20:47:08.605Z", "fetchedAt": "2026-10-23T02:43:47.582Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft SharePoint Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.5535.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.10417.20083", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.19127.20442", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20963", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "fetchedAt": "2026-10-23T02:43:47.582Z", "publishedAt": "2026-01-13T17:56:49.798Z", "modifiedAt": "2026-07-30T20:47:08.605Z", "state": "published", "provider": "microsoft", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.0", "lessThan": "16.0.5535.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.0", "lessThan": "16.0.10417.20083", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "16.0.19127.20442", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en-US", "description": "CWE-502: Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "label": "Microsoft SharePoint Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5535.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20083\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19127.20442\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-502: Deserialization of Untrusted Data\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-502\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-30T20:47:08.605Z", "fetchedAt": "2026-10-23T02:43:47.582Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:33.692Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "074f1487c7ce83e75383968f9ceb10cf531460f3c68bab0dc4268be9f9a112e7", "sourceModifiedAt": "2026-07-30T20:47:08.605Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office SharePoint の信頼できないデータの逆シリアライズにより、認可されていない攻撃者がネットワーク越しにコードを実行できるリモートコード実行脆弱性です。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Microsoft SharePoint Enterprise Server 2016（x64 系、バージョン 16.0.0 以上 16.0.5535.1001 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "Microsoft SharePoint Server 2019（x64 系、バージョン 16.0.0 以上 16.0.10417.20083 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E4", "E1" ] }, { "text": "Microsoft SharePoint Server Subscription Edition（x64 系、バージョン 16.0.0 以上 16.0.19127.20442 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E5", "E1" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5535.1001未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20083未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19127.20442未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20963", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "https://nvd.nist.gov/vuln/detail/CVE-2026-20963" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20963", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "https://nvd.nist.gov/vuln/detail/CVE-2026-20963" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20963", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "https://nvd.nist.gov/vuln/detail/CVE-2026-20963" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20963", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft SharePoint Remote Code Execution Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5535.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20083\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20963.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19127.20442\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20963", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20963\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20963（Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft SharePoint Enterprise Server 2016（x64 系、バージョン 16.0.0 以上 16.0.5535.1001 未満）が影響を受けます。\n・Microsoft SharePoint Server 2019（x64 系、バージョン 16.0.0 以上 16.0.10417.20083 未満）が影響を受けます。\n・Microsoft SharePoint Server Subscription Edition（x64 系、バージョン 16.0.0 以上 16.0.19127.20442 未満）が影響を受けます。\n・公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5535.1001未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20083未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19127.20442未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20963", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:33.692Z", "lastSuccess": "2026-10-23T03:24:33.692Z", "sourceCheckedAt": "2026-10-23T02:43:47.582Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-47813", "aliases": [], "title": "Wing FTP Server：脆弱性情報", "summary": "Wing FTP Server の loginok.html が、UID クッキーに長い値を使用した場合に、アプリケーションのローカルインストールパス全体を開示します。この問題はバージョン 7.4.4 未満に存在します。", "risk": "ローカルインストールパスが外部に漏れることで、システム構成情報が攻撃者に知られる可能性があります。", "product": "Wing FTP Server", "category": "other", "component": "package", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Wing FTP Server", "range": "< 7.4.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-47813", "label": "CVE公式レコード" }, { "url": "https://www.wftpserver.com/", "label": "CVE掲載の参考情報" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "label": "CVE掲載の参考情報" }, { "url": "https://www.wftpserver.com/serverhistory.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47813", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-10T00:00:00.000Z", "modifiedAt": "2026-03-17T12:41:40.769Z", "fetchedAt": "2026-10-23T02:43:38.607Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Wing FTP Server", "vendor": "wftpserver", "versions": [ { "lessThan": "7.4.4", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-47813", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "fetchedAt": "2026-10-23T02:43:38.607Z", "publishedAt": "2025-07-10T00:00:00.000Z", "modifiedAt": "2026-03-17T12:41:40.769Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wftpserver", "product": "Wing FTP Server", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.4.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-209", "lang": "en", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wftpserver.com/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47813", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Wing FTP Server\",\"vendor\":\"wftpserver\",\"versions\":[{\"lessThan\":\"7.4.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-209\",\"description\":\"CWE-209 Generation of Error Message Containing Sensitive Information\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-17T12:41:40.769Z", "fetchedAt": "2026-10-23T02:43:38.607Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Wing FTP Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:34.153Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f2de62ff735287f60bc1585cbbfdcc9049b9a50e2d2777ff74adedb7a0682e56", "sourceModifiedAt": "2026-03-17T12:41:40.769Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Wing FTP Server の loginok.html が、UID クッキーに長い値を使用した場合に、アプリケーションのローカルインストールパス全体を開示します。この問題はバージョン 7.4.4 未満に存在します。", "risk": "ローカルインストールパスが外部に漏れることで、システム構成情報が攻撃者に知られる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Wing FTP Server のバージョンが 7.4.4 未満のすべてのリリースが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：wftpserver / Wing FTP Server。影響ありとして記載：7.4.4未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Wing FTP Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-47813", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47813" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-47813", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47813" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-47813", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47813" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-47813", "label": "CVE公式レコード" }, { "url": "https://www.wftpserver.com/", "label": "CVE掲載の参考情報" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt", "label": "CVE掲載の参考情報" }, { "url": "https://www.wftpserver.com/serverhistory.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47813", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47813.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Wing FTP Server\",\"vendor\":\"wftpserver\",\"versions\":[{\"lessThan\":\"7.4.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47813", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-47813\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-47813（Wing FTP Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Wing FTP Server のバージョンが 7.4.4 未満のすべてのリリースが影響を受けます。\n・公式の対象表：wftpserver / Wing FTP Server。影響ありとして記載：7.4.4未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-47813", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:34.153Z", "lastSuccess": "2026-10-23T03:24:34.153Z", "sourceCheckedAt": "2026-10-23T02:43:38.607Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-3909", "aliases": [], "title": "Chrome：脆弱性情報", "summary": "Google Chrome のバージョン 146.0.7680.75 未満に含まれる Skia コンポーネントに、境界外書き込みの欠陥があり、攻撃者が細工した HTML ページを通じてメモリの境界外にアクセスできる可能性があります。", "risk": "リモートの攻撃者が境界外メモリアクセスを実行できるため、システムの安全性が脅かされる可能性があります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 146.0.7680.75 / < 146.0.7680.75" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3909", "label": "CVE公式レコード" }, { "url": "https://issues.chromium.org/issues/491421267", "label": "CVE掲載の参考情報" }, { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3909", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-03-12T21:30:51.265Z", "modifiedAt": "2026-03-24T21:17:08.100Z", "fetchedAt": "2026-10-23T02:43:48.722Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "146.0.7680.75", "status": "affected", "lessThan": "146.0.7680.75", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-3909", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "fetchedAt": "2026-10-23T02:43:48.722Z", "publishedAt": "2026-03-12T21:30:51.265Z", "modifiedAt": "2026-03-24T21:17:08.100Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "146.0.7680.75", "lessThan": "146.0.7680.75", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "Out of bounds write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://issues.chromium.org/issues/491421267", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"146.0.7680.75\",\"status\":\"affected\",\"lessThan\":\"146.0.7680.75\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Out of bounds write\",\"cweId\":\"CWE-787\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-24T21:17:08.100Z", "fetchedAt": "2026-10-23T02:43:48.722Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-13T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:12.603Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "638b21202115a4f38a31e34d25927a083a8fbeafd54f7ae9134067bbf874d03c", "sourceModifiedAt": "2026-03-24T21:17:08.100Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome のバージョン 146.0.7680.75 未満に含まれる Skia コンポーネントに、境界外書き込みの欠陥があり、攻撃者が細工した HTML ページを通じてメモリの境界外にアクセスできる可能性があります。", "risk": "リモートの攻撃者が境界外メモリアクセスを実行できるため、システムの安全性が脅かされる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョン 146.0.7680.75 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも146.0.7680.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-3909", "https://issues.chromium.org/issues/491421267", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "https://nvd.nist.gov/vuln/detail/CVE-2026-3909" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-3909", "https://issues.chromium.org/issues/491421267", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "https://nvd.nist.gov/vuln/detail/CVE-2026-3909" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-3909", "https://issues.chromium.org/issues/491421267", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "https://nvd.nist.gov/vuln/detail/CVE-2026-3909" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3909", "label": "CVE公式レコード" }, { "url": "https://issues.chromium.org/issues/491421267", "label": "CVE掲載の参考情報" }, { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3909", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3909.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"146.0.7680.75\",\"status\":\"affected\",\"lessThan\":\"146.0.7680.75\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3909", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-3909\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-3909（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョン 146.0.7680.75 未満が影響を受けます。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも146.0.7680.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-3909", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:12.603Z", "lastSuccess": "2026-10-23T03:38:12.603Z", "sourceCheckedAt": "2026-10-23T02:43:48.722Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-3910", "aliases": [], "title": "Chrome：コード実行", "summary": "Google Chrome の V8 の不適切な実装により、バージョン 146.0.7680.75 未満の Chrome を使用している場合、細工された HTML ページを通してリモートの攻撃者がサンドボックス内で任意のコードを実行できる。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できる可能性がある。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 146.0.7680.75 / < 146.0.7680.75" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3910", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/491410818", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3910", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-03-12T21:30:51.861Z", "modifiedAt": "2026-03-14T03:55:26.662Z", "fetchedAt": "2026-10-23T02:43:48.728Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "146.0.7680.75", "status": "affected", "lessThan": "146.0.7680.75", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-3910", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "fetchedAt": "2026-10-23T02:43:48.728Z", "publishedAt": "2026-03-12T21:30:51.861Z", "modifiedAt": "2026-03-14T03:55:26.662Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "146.0.7680.75", "lessThan": "146.0.7680.75", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Inappropriate implementation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/491410818", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"146.0.7680.75\",\"status\":\"affected\",\"lessThan\":\"146.0.7680.75\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Inappropriate implementation\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-14T03:55:26.662Z", "fetchedAt": "2026-10-23T02:43:48.728Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-13T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:15.088Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "47f5c43eaac82a924b4c9a57b08d12b719f7d9d1b1e8201d61dcc7208629a4e0", "sourceModifiedAt": "2026-03-14T03:55:26.662Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 の不適切な実装により、バージョン 146.0.7680.75 未満の Chrome を使用している場合、細工された HTML ページを通してリモートの攻撃者がサンドボックス内で任意のコードを実行できる。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョン 146.0.7680.75 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E2" ] }, { "text": "細工された HTML ページを閲覧したユーザーのブラウザーでコードが実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも146.0.7680.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-3910", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "https://issues.chromium.org/issues/491410818", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "https://nvd.nist.gov/vuln/detail/CVE-2026-3910" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-3910", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "https://issues.chromium.org/issues/491410818", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "https://nvd.nist.gov/vuln/detail/CVE-2026-3910" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-3910", "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "https://issues.chromium.org/issues/491410818", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "https://nvd.nist.gov/vuln/detail/CVE-2026-3910" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3910", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/491410818", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3910", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3910.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"146.0.7680.75\",\"status\":\"affected\",\"lessThan\":\"146.0.7680.75\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-3910\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-3910（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョン 146.0.7680.75 未満が影響を受ける。\n・細工された HTML ページを閲覧したユーザーのブラウザーでコードが実行される。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも146.0.7680.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-3910", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:15.088Z", "lastSuccess": "2026-10-23T03:38:15.088Z", "sourceCheckedAt": "2026-10-23T02:43:48.728Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-68613", "aliases": [], "title": "n8n：コード実行", "summary": "n8n はオープンソースのワークフロー自動化プラットフォームです。バージョン 0.211.0 以降で、1.120.4、1.121.1、1.122.0 より前のバージョンに、ワークフローの式評価システムにおける重大なリモートコード実行（RCE）脆弱性が存在します。認証済みユーザーがワークフロー設定時に提供した式が、ランタイムから十分に分離されていない実行コンテキストで評価される条件下で、攻撃者は n8n プロセスの権限で任意のコードを実行できる可能性があります。", "risk": "攻撃が成功すると、対象インスタンスが完全に乗っ取られ、機密データへの不正アクセス、ワークフローの改ざん、システムレベルの操作が実行される恐れがあります。", "product": "n8n", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "n8n", "range": ">= 0.211.0, < 1.120.4" }, { "product": "n8n", "range": "= 1.121.0" } ], "fixed": [], "steps": [ "バージョン 1.120.4、1.121.1、1.122.0 にアップグレードして脆弱性を修正してください。", "「CVE-2025-68613」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68613", "label": "CVE公式レコード" }, { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "label": "CISAが示す関連情報" }, { "url": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "label": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79" }, { "url": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "label": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000" }, { "url": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "label": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68613", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-19T22:23:47.777Z", "modifiedAt": "2026-03-12T03:55:15.270Z", "fetchedAt": "2026-10-23T02:43:40.300Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.", "sourceTitle": "n8n Vulnerable to Remote Code Execution via Expression Injection", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n8n-io", "product": "n8n", "versions": [ { "version": ">= 0.211.0, < 1.120.4", "status": "affected" }, { "version": "= 1.121.0", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-68613", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "fetchedAt": "2026-10-23T02:43:40.300Z", "publishedAt": "2025-12-19T22:23:47.777Z", "modifiedAt": "2026-03-12T03:55:15.270Z", "state": "published", "provider": "GitHub_M", "title": "n8n Vulnerable to Remote Code Execution via Expression Injection", "descriptions": [ { "lang": "en", "value": "n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n8n-io", "product": "n8n", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">= 0.211.0, < 1.120.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "= 1.121.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-913", "lang": "en", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "label": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "label": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "label": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "label": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68613", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n8n-io\",\"product\":\"n8n\",\"versions\":[{\"version\":\">= 0.211.0, < 1.120.4\",\"status\":\"affected\"},{\"version\":\"= 1.121.0\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-913\",\"lang\":\"en\",\"description\":\"CWE-913: Improper Control of Dynamically-Managed Code Resources\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-12T03:55:15.270Z", "fetchedAt": "2026-10-23T02:43:40.300Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-11T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n8nにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:37.316Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d05ebb10038e5de74786049e6a6e3ac066222eec7304796aa561f1614e7b00a9", "sourceModifiedAt": "2026-03-12T03:55:15.270Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "n8n はオープンソースのワークフロー自動化プラットフォームです。バージョン 0.211.0 以降で、1.120.4、1.121.1、1.122.0 より前のバージョンに、ワークフローの式評価システムにおける重大なリモートコード実行（RCE）脆弱性が存在します。認証済みユーザーがワークフロー設定時に提供した式が、ランタイムから十分に分離されていない実行コンテキストで評価される条件下で、攻撃者は n8n プロセスの権限で任意のコードを実行できる可能性があります。", "risk": "攻撃が成功すると、対象インスタンスが完全に乗っ取られ、機密データへの不正アクセス、ワークフローの改ざん、システムレベルの操作が実行される恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 0.211.0 以上かつ 1.120.4 未満の n8n が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 1.121.0 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：n8n-io / n8n。影響ありとして記載：>= 0.211.0, < 1.120.4。影響ありとして記載：= 1.121.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E3" ] }, { "text": "「n8n」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68613", "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "https://nvd.nist.gov/vuln/detail/CVE-2025-68613" ] } ], "actions": [ { "text": "バージョン 1.120.4、1.121.1、1.122.0 にアップグレードして脆弱性を修正してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2025-68613」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-68613", "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "https://nvd.nist.gov/vuln/detail/CVE-2025-68613" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68613", "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "https://nvd.nist.gov/vuln/detail/CVE-2025-68613" ] } ], "temporaryMitigations": [ { "text": "ワークフローの作成・編集権限を完全に信頼できるユーザーのみに制限してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E1" ] }, { "text": "n8n を OS 権限とネットワークアクセスが制限されたハード化環境で実行し、潜在的な影響を低減してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E1" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68613", "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "https://nvd.nist.gov/vuln/detail/CVE-2025-68613" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68613", "label": "CVE公式レコード" }, { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp", "label": "CISAが示す関連情報" }, { "url": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79", "label": "https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79" }, { "url": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000", "label": "https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000" }, { "url": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316", "label": "https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68613", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourceField": "/containers/cna/title", "excerpt": "n8n Vulnerable to Remote Code Execution via Expression Injection", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68613.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n8n-io\",\"product\":\"n8n\",\"versions\":[{\"version\":\">= 0.211.0, < 1.120.4\",\"status\":\"affected\"},{\"version\":\"= 1.121.0\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68613", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-68613\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-68613（n8n）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 0.211.0 以上かつ 1.120.4 未満の n8n が影響を受けます。\n・バージョン 1.121.0 が影響を受けます。\n・公式の対象表：n8n-io / n8n。影響ありとして記載：>= 0.211.0, < 1.120.4。影響ありとして記載：= 1.121.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-68613", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:37.316Z", "lastSuccess": "2026-10-23T03:24:37.316Z", "sourceCheckedAt": "2026-10-23T02:43:40.300Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2021-22054", "aliases": [], "title": "VMware Workspace ONE UEM console：情報の漏えい", "summary": "VMware Workspace ONE UEM コンソールの 20.0.8（20.0.8.37 未満）、20.11.0（20.11.0.40 未満）、21.2.0（21.2.0.27 未満）、21.5.0（21.5.0.37 未満）に SSRF の脆弱性が含まれます。この問題により、UEM のネットワークにアクセスできる攻撃者が認証なしでリクエストを送信でき、機密情報にアクセスできる可能性があります。", "risk": "認証なしでリクエストを送信できるため、機密情報が漏洩する恐れがあります。", "product": "VMware Workspace ONE UEM console", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "vmware", "cvssVector": null, "affected": [ { "product": "VMware Workspace ONE UEM console", "range": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37." } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22054", "label": "CVE公式レコード" }, { "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22054", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-12-17T16:10:18.000Z", "modifiedAt": "2026-10-01T18:11:30.042Z", "fetchedAt": "2026-10-23T02:43:14.922Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "VMware Workspace ONE UEM console", "vendor": "n/a", "versions": [ { "status": "affected", "version": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37." } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-22054", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "fetchedAt": "2026-10-23T02:43:14.922Z", "publishedAt": "2021-12-17T16:10:18.000Z", "modifiedAt": "2026-10-01T18:11:30.042Z", "state": "published", "provider": "vmware", "title": "", "descriptions": [ { "lang": "en", "value": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "VMware Workspace ONE UEM console", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37.", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "VMware Workspace ONE UEM console patches SSRF vulnerability", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.greynoise.io/blog/new-ssrf-exploitation-surge", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"VMware Workspace ONE UEM console\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37.\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"VMware Workspace ONE UEM console patches SSRF vulnerability\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T18:11:30.042Z", "fetchedAt": "2026-10-23T02:43:14.922Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "VMware Workspace ONE UEM consoleに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:37.564Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d2aeee06bf8de6e13220dc79124e2762f0a956c9c250566aec1ca6037e60e234", "sourceModifiedAt": "2026-10-01T18:11:30.042Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "VMware Workspace ONE UEM コンソールの 20.0.8（20.0.8.37 未満）、20.11.0（20.11.0.40 未満）、21.2.0（21.2.0.27 未満）、21.5.0（21.5.0.37 未満）に SSRF の脆弱性が含まれます。この問題により、UEM のネットワークにアクセスできる攻撃者が認証なしでリクエストを送信でき、機密情報にアクセスできる可能性があります。", "risk": "認証なしでリクエストを送信できるため、機密情報が漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは、VMware Workspace ONE UEM コンソールの 20.0.8（20.0.8.37 未満）、20.11.0（20.11.0.40 未満）、21.2.0（21.2.0.27 未満）、21.5.0（21.5.0.37 未満）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json" ], "evidenceIds": [ "E2" ] }, { "text": "「VMware Workspace ONE UEM console」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22054", "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://nvd.nist.gov/vuln/detail/CVE-2021-22054" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-22054", "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://nvd.nist.gov/vuln/detail/CVE-2021-22054" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22054", "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "https://nvd.nist.gov/vuln/detail/CVE-2021-22054" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22054", "label": "CVE公式レコード" }, { "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20211222154335/https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22054", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"VMware Workspace ONE UEM console\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37.\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22054", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-22054\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-22054（VMware Workspace ONE UEM console）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは、VMware Workspace ONE UEM コンソールの 20.0.8（20.0.8.37 未満）、20.11.0（20.11.0.40 未満）、21.2.0（21.2.0.27 未満）、21.5.0（21.5.0.37 未満）です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-22054", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:37.564Z", "lastSuccess": "2026-10-23T03:24:37.564Z", "sourceCheckedAt": "2026-10-23T02:43:14.922Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2025-26399", "aliases": [], "title": "Web Help Desk：権限の奪取", "summary": "SolarWinds Web Help Desk は、認証されていない AjaxProxy のデシリアライズに起因するリモートコード実行脆弱性が存在し、攻撃者がホストマシン上でコマンドを実行できる可能性があります。この脆弱性は CVE-2024-28988 のパッチ回避であり、さらに CVE-2024-28986 のパッチ回避でもあります。", "risk": "攻撃者がホストマシン上で任意のコマンドを実行できる可能性があります。", "product": "Web Help Desk", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "SolarWinds", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Web Help Desk", "range": "12.8.7 and below" } ], "fixed": [], "steps": [ "SolarWinds は、実務上可能な限り速やかに Web Help Desk バージョン 12.8.7 HF1 にアップグレードすることを推奨しています。", "「CVE-2025-26399」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "label": "CVE：SolarWinds" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-26399", "label": "CVE公式レコード" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "label": "CVE掲載の参考情報" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26399", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-09-23T05:07:14.702Z", "modifiedAt": "2026-08-04T03:55:57.668Z", "fetchedAt": "2026-10-23T02:43:36.885Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.", "sourceTitle": "SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Web Help Desk", "vendor": "SolarWinds", "versions": [ { "status": "affected", "version": "12.8.7 and below" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-26399", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "fetchedAt": "2026-10-23T02:43:36.885Z", "publishedAt": "2025-09-23T05:07:14.702Z", "modifiedAt": "2026-08-04T03:55:57.668Z", "state": "published", "provider": "SolarWinds", "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability", "descriptions": [ { "lang": "en", "value": "SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SolarWinds", "product": "Web Help Desk", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.8.7 and below", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "SolarWinds", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "label": "SolarWinds", "tags": [], "provider": "SolarWinds", "sourcePath": "/containers/cna/references/0" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "label": "SolarWinds", "tags": [], "provider": "SolarWinds", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Web Help Desk\",\"vendor\":\"SolarWinds\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.8.7 and below\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-502\",\"description\":\"CWE-502: Deserialization of Untrusted Data\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:55:57.668Z", "fetchedAt": "2026-10-23T02:43:36.885Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Web Help Deskに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:37.921Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "437db0bf110193e5bd9cfd8abb1eeae32173839ccead1db5c8a0710ff1410d08", "sourceModifiedAt": "2026-08-04T03:55:57.668Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SolarWinds Web Help Desk は、認証されていない AjaxProxy のデシリアライズに起因するリモートコード実行脆弱性が存在し、攻撃者がホストマシン上でコマンドを実行できる可能性があります。この脆弱性は CVE-2024-28988 のパッチ回避であり、さらに CVE-2024-28986 のパッチ回避でもあります。", "risk": "攻撃者がホストマシン上で任意のコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない状態で AjaxProxy を介したデシリアライズが可能な Web Help Desk のバージョン 12.8.7 以下が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "公式の対象表：SolarWinds / Web Help Desk。影響ありとして記載：12.8.7 and below。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Web Help Desk」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "https://nvd.nist.gov/vuln/detail/CVE-2025-26399" ] } ], "actions": [ { "text": "SolarWinds は、実務上可能な限り速やかに Web Help Desk バージョン 12.8.7 HF1 にアップグレードすることを推奨しています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2025-26399」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "https://nvd.nist.gov/vuln/detail/CVE-2025-26399" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "https://nvd.nist.gov/vuln/detail/CVE-2025-26399" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "https://nvd.nist.gov/vuln/detail/CVE-2025-26399" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "https://nvd.nist.gov/vuln/detail/CVE-2025-26399" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "label": "CVE：SolarWinds" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-26399", "label": "CVE公式レコード" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399", "label": "CVE掲載の参考情報" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26399", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourceField": "/containers/cna/title", "excerpt": "SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Web Help Desk\",\"vendor\":\"SolarWinds\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.8.7 and below\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/26xxx/CVE-2025-26399.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-26399", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-26399\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-26399（Web Help Desk）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない状態で AjaxProxy を介したデシリアライズが可能な Web Help Desk のバージョン 12.8.7 以下が対象です。\n・公式の対象表：SolarWinds / Web Help Desk。影響ありとして記載：12.8.7 and below。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-26399", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:37.921Z", "lastSuccess": "2026-10-23T03:24:37.921Z", "sourceCheckedAt": "2026-10-23T02:43:36.885Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-1603", "aliases": [], "title": "Endpoint Manager：認証の回避", "summary": "Ivanti Endpoint Manager の 2024 SU5 より前のバージョンに認証バイパスの脆弱性があり、リモートの認証されていない攻撃者が特定の保存された認証情報データを漏洩させることができる。", "risk": "攻撃者が認証情報データを取得できる可能性がある。", "product": "Endpoint Manager", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "ivanti", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "Endpoint Manager", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1603", "label": "CVE公式レコード" }, { "url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1603", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-10T15:09:35.459Z", "modifiedAt": "2026-03-10T03:55:23.819Z", "fetchedAt": "2026-10-23T02:43:46.558Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "Endpoint Manager", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "2024 SU5" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-1603", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "fetchedAt": "2026-10-23T02:43:46.558Z", "publishedAt": "2026-02-10T15:09:35.459Z", "modifiedAt": "2026-03-10T03:55:23.819Z", "state": "published", "provider": "ivanti", "title": "", "descriptions": [ { "lang": "en", "value": "An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Ivanti", "product": "Endpoint Manager", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2024 SU5", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "ivanti", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "label": "ivanti", "tags": [], "provider": "ivanti", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"Endpoint Manager\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"2024 SU5\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-288\",\"description\":\"CWE-288: Authentication Bypass Using an Alternate Path or Channel\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-10T03:55:23.819Z", "fetchedAt": "2026-10-23T02:43:46.558Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Endpoint Managerに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:37.952Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3a925206c6b97c58aeb53d7e239ca1627ba9c9f19a6bdd9536ed49cfda3a7061", "sourceModifiedAt": "2026-03-10T03:55:23.819Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ivanti Endpoint Manager の 2024 SU5 より前のバージョンに認証バイパスの脆弱性があり、リモートの認証されていない攻撃者が特定の保存された認証情報データを漏洩させることができる。", "risk": "攻撃者が認証情報データを取得できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Endpoint Manager が 2024 SU5 より前のバージョンである場合に脆弱性が存在する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "リモートの認証されていない攻撃者が利用できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Ivanti / Endpoint Manager。影響なしとして記載：2024 SU5。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Endpoint Manager」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-1603", "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "https://nvd.nist.gov/vuln/detail/CVE-2026-1603" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-1603", "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "https://nvd.nist.gov/vuln/detail/CVE-2026-1603" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-1603", "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "https://nvd.nist.gov/vuln/detail/CVE-2026-1603" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1603", "label": "CVE公式レコード" }, { "url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1603", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1603.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"Endpoint Manager\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"2024 SU5\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1603", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-1603\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-1603（Endpoint Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Endpoint Manager が 2024 SU5 より前のバージョンである場合に脆弱性が存在する。\n・リモートの認証されていない攻撃者が利用できる。\n・公式の対象表：Ivanti / Endpoint Manager。影響なしとして記載：2024 SU5。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-1603", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:37.952Z", "lastSuccess": "2026-10-23T03:24:37.952Z", "sourceCheckedAt": "2026-10-23T02:43:46.558Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2017-7921", "aliases": [], "title": "Hikvision Cameras：情報の漏えい", "summary": "Hikvision DS-2CD2xx2F-I シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160530）、DS-2CD2xx0F-I シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160401）、DS-2CD2xx2FWD シリーズ（V5.3.1 ビルド 150410 から V5.4.4 ビルド 161125）、DS-2CD4x2xFWD シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160414）、DS-2CD4xx5 シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160421）、DS-2DFx シリーズ（V5.2.0 ビルド 140805 から V5.4.5 ビルド 160928）、および DS-2CD63xx シリーズ（V5.0.9 ビルド 140305 から V5.3.5 ビルド 160106）のカメラに、認証が不適切に行われる問題があり、攻撃者が権限を昇格させて機密情報にアクセスできる可能性があります。", "risk": "不適切な認証により、攻撃者が権限を昇格させ、機密情報にアクセスできる恐れがあります。", "product": "Hikvision Cameras", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "icscert", "cvssVector": null, "affected": [ { "product": "Hikvision Cameras", "range": "Hikvision Cameras" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-7921", "label": "CVE公式レコード" }, { "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/98313", "label": "98313" }, { "url": "https://ghostbin.com/paste/q2vq2", "label": "CVE掲載の参考情報" }, { "url": "http://www.hikvision.com/us/about_10805.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7921", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2017-05-06T00:00:00.000Z", "modifiedAt": "2026-03-06T05:01:18.718Z", "fetchedAt": "2026-10-23T02:43:03.104Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Hikvision Cameras", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Hikvision Cameras" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2017-7921", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "fetchedAt": "2026-10-23T02:43:03.104Z", "publishedAt": "2017-05-06T00:00:00.000Z", "modifiedAt": "2026-03-06T05:01:18.718Z", "state": "published", "provider": "icscert", "title": "", "descriptions": [ { "lang": "en", "value": "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "Hikvision Cameras", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Hikvision Cameras", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://www.securityfocus.com/bid/98313", "label": "98313", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://ghostbin.com/paste/q2vq2", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.hikvision.com/us/about_10805.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Hikvision Cameras\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"Hikvision Cameras\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-287\",\"description\":\"CWE-287\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-06T05:01:18.718Z", "fetchedAt": "2026-10-23T02:43:03.104Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-05T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Hikvision Camerasに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:38.340Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "cf4eb37c444bede1261cda4141185afd9c5ddd3bab53d06292f68b4f2a2e69cc", "sourceModifiedAt": "2026-03-06T05:01:18.718Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Hikvision DS-2CD2xx2F-I シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160530）、DS-2CD2xx0F-I シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160401）、DS-2CD2xx2FWD シリーズ（V5.3.1 ビルド 150410 から V5.4.4 ビルド 161125）、DS-2CD4x2xFWD シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160414）、DS-2CD4xx5 シリーズ（V5.2.0 ビルド 140721 から V5.4.0 ビルド 160421）、DS-2DFx シリーズ（V5.2.0 ビルド 140805 から V5.4.5 ビルド 160928）、および DS-2CD63xx シリーズ（V5.0.9 ビルド 140305 から V5.3.5 ビルド 160106）のカメラに、認証が不適切に行われる問題があり、攻撃者が権限を昇格させて機密情報にアクセスできる可能性があります。", "risk": "不適切な認証により、攻撃者が権限を昇格させ、機密情報にアクセスできる恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "DS-2CD2xx2F-I シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160530 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2CD2xx0F-I シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160401 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2CD2xx2FWD シリーズの V5.3.1 ビルド 150410 から V5.4.4 ビルド 161125 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2CD4x2xFWD シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160414 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2CD4xx5 シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160421 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2DFx シリーズの V5.2.0 ビルド 140805 から V5.4.5 ビルド 160928 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "DS-2CD63xx シリーズの V5.0.9 ビルド 140305 から V5.3.5 ビルド 160106 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Hikvision Cameras。影響ありとして記載：Hikvision Cameras。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Hikvision Cameras」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-7921", "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "http://www.securityfocus.com/bid/98313", "https://ghostbin.com/paste/q2vq2", "http://www.hikvision.com/us/about_10805.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "https://nvd.nist.gov/vuln/detail/CVE-2017-7921" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2017-7921", "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "http://www.securityfocus.com/bid/98313", "https://ghostbin.com/paste/q2vq2", "http://www.hikvision.com/us/about_10805.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "https://nvd.nist.gov/vuln/detail/CVE-2017-7921" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-7921", "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "http://www.securityfocus.com/bid/98313", "https://ghostbin.com/paste/q2vq2", "http://www.hikvision.com/us/about_10805.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "https://nvd.nist.gov/vuln/detail/CVE-2017-7921" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-7921", "label": "CVE公式レコード" }, { "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/98313", "label": "98313" }, { "url": "https://ghostbin.com/paste/q2vq2", "label": "CVE掲載の参考情報" }, { "url": "http://www.hikvision.com/us/about_10805.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7921", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/7xxx/CVE-2017-7921.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Hikvision Cameras\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"Hikvision Cameras\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7921", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2017-7921\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2017-7921（Hikvision Cameras）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・DS-2CD2xx2F-I シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160530 が影響を受けます。\n・DS-2CD2xx0F-I シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160401 が影響を受けます。\n・DS-2CD2xx2FWD シリーズの V5.3.1 ビルド 150410 から V5.4.4 ビルド 161125 が影響を受けます。\n・DS-2CD4x2xFWD シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160414 が影響を受けます。\n・DS-2CD4xx5 シリーズの V5.2.0 ビルド 140721 から V5.4.0 ビルド 160421 が影響を受けます。\n・DS-2DFx シリーズの V5.2.0 ビルド 140805 から V5.4.5 ビルド 160928 が影響を受けます。\n・DS-2CD63xx シリーズの V5.0.9 ビルド 140305 から V5.3.5 ビルド 160106 が影響を受けます。\n・公式の対象表：Hikvision Cameras。影響ありとして記載：Hikvision Cameras。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2017-7921", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:38.340Z", "lastSuccess": "2026-10-23T03:24:38.340Z", "sourceCheckedAt": "2026-10-23T02:43:03.104Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2021-22681", "aliases": [], "title": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers：脆弱性情報", "summary": "Rockwell Automation の Studio 5000 Logix Designer（バージョン 21 以降）および RSLogix 5000（バージョン 16 から 20）では、Logix コントローラが Rockwell Automation の CompactLogix、ControlLogix、DriveLogix、Compact GuardLogix、GuardLogix、SoftLogix と通信しているかを確認するための鍵が使用されていますが、認証されていない攻撃者がこの確認機構を回避し、これらのコントローラに対して不正に認証できる脆弱性があります。", "risk": "攻撃者が認証を回避して対象のコントローラに不正にアクセスできる可能性があります。", "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "icscert", "cvssVector": null, "affected": [ { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "RSLogix 5000 Versions 16 through 20" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "Studio 5000 Logix Designer: Versions 21 and later" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "CompactLogix 1768, 1769, 5370, 5380, 5480" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "ControlLogix 5550, 5560, 5570, 5580" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "DriveLogix 5560, 5730, 1794-L34" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "Compact GuardLogix 5370, 5380" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "GuardLogix 5570, 5580" }, { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "range": "SoftLogix 5800" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "label": "CVE：icscert" }, { "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22681", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681", "label": "CISA KEV（悪用確認）" }, { "url": "https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22681", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-03-03T17:59:43.000Z", "modifiedAt": "2026-03-06T05:01:20.925Z", "fetchedAt": "2026-10-23T02:43:15.283Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "vendor": "n/a", "versions": [ { "status": "affected", "version": "RSLogix 5000 Versions 16 through 20" }, { "status": "affected", "version": "Studio 5000 Logix Designer: Versions 21 and later" }, { "status": "affected", "version": "CompactLogix 1768, 1769, 5370, 5380, 5480" }, { "status": "affected", "version": "ControlLogix 5550, 5560, 5570, 5580" }, { "status": "affected", "version": "DriveLogix 5560, 5730, 1794-L34" }, { "status": "affected", "version": "Compact GuardLogix 5370, 5380" }, { "status": "affected", "version": "GuardLogix 5570, 5580" }, { "status": "affected", "version": "SoftLogix 5800" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-22681", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "fetchedAt": "2026-10-23T02:43:15.283Z", "publishedAt": "2021-03-03T17:59:43.000Z", "modifiedAt": "2026-03-06T05:01:20.925Z", "state": "published", "provider": "icscert", "title": "", "descriptions": [ { "lang": "en", "value": "Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "RSLogix 5000 Versions 16 through 20", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "Studio 5000 Logix Designer: Versions 21 and later", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "CompactLogix 1768, 1769, 5370, 5380, 5480", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "ControlLogix 5550, 5560, 5570, 5580", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "DriveLogix 5560, 5730, 1794-L34", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "Compact GuardLogix 5370, 5380", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "GuardLogix 5570, 5580", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "SoftLogix 5800", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-522", "lang": "en", "description": "Insufficiently Protected Credentials CWE-522", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"RSLogix 5000 Versions 16 through 20\"},{\"status\":\"affected\",\"version\":\"Studio 5000 Logix Designer: Versions 21 and later\"},{\"status\":\"affected\",\"version\":\"CompactLogix 1768, 1769, 5370, 5380, 5480\"},{\"status\":\"affected\",\"version\":\"ControlLogix 5550, 5560, 5570, 5580\"},{\"status\":\"affected\",\"version\":\"DriveLogix 5560, 5730, 1794-L34\"},{\"status\":\"affected\",\"version\":\"Compact GuardLogix 5370, 5380\"},{\"status\":\"affected\",\"version\":\"GuardLogix 5570, 5580\"},{\"status\":\"affected\",\"version\":\"SoftLogix 5800\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-522\",\"description\":\"Insufficiently Protected Credentials CWE-522\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-06T05:01:20.925Z", "fetchedAt": "2026-10-23T02:43:15.283Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-05T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllersに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:39.364Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f3b8ab17d3147de1ef4d746c15295b06e9aff87ffd5fc25695f136c992ba007f", "sourceModifiedAt": "2026-03-06T05:01:20.925Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Rockwell Automation の Studio 5000 Logix Designer（バージョン 21 以降）および RSLogix 5000（バージョン 16 から 20）では、Logix コントローラが Rockwell Automation の CompactLogix、ControlLogix、DriveLogix、Compact GuardLogix、GuardLogix、SoftLogix と通信しているかを確認するための鍵が使用されていますが、認証されていない攻撃者がこの確認機構を回避し、これらのコントローラに対して不正に認証できる脆弱性があります。", "risk": "攻撃者が認証を回避して対象のコントローラに不正にアクセスできる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "RSLogix 5000 バージョン 16 から 20 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "Studio 5000 Logix Designer バージョン 21 以降が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "CompactLogix 1768、1769、5370、5380、5480 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "ControlLogix 5550、5560、5570、5580 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "DriveLogix 5560、5730、1794-L34 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "Compact GuardLogix 5370、5380 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "GuardLogix 5570、5580 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "SoftLogix 5800 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers。影響ありとして記載：GuardLogix 5570, 5580。影響ありとして記載：SoftLogix 5800。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22681", "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681", "https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-", "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03", "https://nvd.nist.gov/vuln/detail/CVE-2021-22681" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-22681", "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681", "https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-", "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03", "https://nvd.nist.gov/vuln/detail/CVE-2021-22681" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22681", "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681", "https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-", "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03", "https://nvd.nist.gov/vuln/detail/CVE-2021-22681" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "label": "CVE：icscert" }, { "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22681", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681", "label": "CISA KEV（悪用確認）" }, { "url": "https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22681", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22681.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"RSLogix 5000 Versions 16 through 20\"},{\"status\":\"affected\",\"version\":\"Studio 5000 Logix Designer: Versions 21 and later\"},{\"status\":\"affected\",\"version\":\"CompactLogix 1768, 1769, 5370, 5380, 5480\"},{\"status\":\"affected\",\"version\":\"ControlLogix 5550, 5560, 5570, 5580\"},{\"status\":\"affected\",\"version\":\"DriveLogix 5560, 5730, 1794-L34\"},{\"status\":\"affected\",\"version\":\"Compact GuardLogix 5370, 5380\"},{\"status\":\"affected\",\"version\":\"GuardLogix 5570, 5580\"},{\"status\":\"affected\",\"version\":\"SoftLogix 5800\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-22681\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-22681（Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・RSLogix 5000 バージョン 16 から 20 が影響を受けます。\n・Studio 5000 Logix Designer バージョン 21 以降が影響を受けます。\n・CompactLogix 1768、1769、5370、5380、5480 が影響を受けます。\n・ControlLogix 5550、5560、5570、5580 が影響を受けます。\n・DriveLogix 5560、5730、1794-L34 が影響を受けます。\n・Compact GuardLogix 5370、5380 が影響を受けます。\n・GuardLogix 5570、5580 が影響を受けます。\n・SoftLogix 5800 が影響を受けます。\n・公式の対象表：Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers。影響ありとして記載：GuardLogix 5570, 5580。影響ありとして記載：SoftLogix 5800。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-22681", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:39.364Z", "lastSuccess": "2026-10-23T03:24:39.364Z", "sourceCheckedAt": "2026-10-23T02:43:15.283Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2021-30952", "aliases": [], "title": "watchOS / iOS and iPadOS / macOS：コード実行", "summary": "整数オーバーフローが改善された入力検証により修正されました。この問題は tvOS 15.2、macOS Monterey 12.1、Safari 15.2、iOS 15.2、iPadOS 15.2、watchOS 8.3 で修正されています。悪意のある Web コンテンツを処理すると、任意のコードが実行される可能性があります。", "risk": "悪意のある Web コンテンツを処理すると、サーバーや機器に攻撃者の命令を実行させられる可能性があります。", "product": "watchOS / iOS and iPadOS / macOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "watchOS", "range": ">= unspecified / < 8.3" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.2" }, { "product": "macOS", "range": ">= unspecified / < 12.1" }, { "product": "macOS", "range": ">= unspecified / < 15.2" } ], "fixed": [], "steps": [ "この問題は tvOS 15.2、macOS Monterey 12.1、Safari 15.2、iOS 15.2、iPadOS 15.2、watchOS 8.3 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-30952", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT212975", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212976", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212978", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212980", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212982", "label": "CISAが示す関連情報" }, { "url": "http://www.openwall.com/lists/oss-security/2022/01/21/2", "label": "[oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "label": "FEDORA-2022-25a98f5d55" }, { "url": "https://www.debian.org/security/2022/dsa-5061", "label": "DSA-5061" }, { "url": "https://www.debian.org/security/2022/dsa-5060", "label": "DSA-5060" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "label": "FEDORA-2022-f7366e60cb" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-08-24T18:50:52.000Z", "modifiedAt": "2026-03-06T05:01:17.601Z", "fetchedAt": "2026-10-23T02:43:17.353Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "8.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "15.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.1", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-30952", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "fetchedAt": "2026-10-23T02:43:17.353Z", "publishedAt": "2021-08-24T18:50:52.000Z", "modifiedAt": "2026-03-06T05:01:17.601Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "8.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "15.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "12.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "15.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "unspecified", "lessThan": "15.2", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing maliciously crafted web content may lead to arbitrary code execution", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/HT212975", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/en-us/HT212976", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://support.apple.com/en-us/HT212978", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://support.apple.com/en-us/HT212980", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://support.apple.com/en-us/HT212982", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.openwall.com/lists/oss-security/2022/01/21/2", "label": "[oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "label": "FEDORA-2022-25a98f5d55", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.debian.org/security/2022/dsa-5061", "label": "DSA-5061", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://www.debian.org/security/2022/dsa-5060", "label": "DSA-5060", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "label": "FEDORA-2022-f7366e60cb", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"watchOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"8.3\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"iOS and iPadOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"12.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Processing maliciously crafted web content may lead to arbitrary code execution\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-06T05:01:17.601Z", "fetchedAt": "2026-10-23T02:43:17.353Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-05T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "watchOS / iOS and iPadOS / macOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:39.604Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4b2750f1daf02d566c5296c695acbd6667362c81a9be0043a737ac8f8b9bff57", "sourceModifiedAt": "2026-03-06T05:01:17.601Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "整数オーバーフローが改善された入力検証により修正されました。この問題は tvOS 15.2、macOS Monterey 12.1、Safari 15.2、iOS 15.2、iPadOS 15.2、watchOS 8.3 で修正されています。悪意のある Web コンテンツを処理すると、任意のコードが実行される可能性があります。", "risk": "悪意のある Web コンテンツを処理すると、サーバーや機器に攻撃者の命令を実行させられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "watchOS のバージョンが 8.3 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E3" ] }, { "text": "iOS および iPadOS のバージョンが 15.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E4" ] }, { "text": "macOS のバージョンが 12.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E5" ] }, { "text": "macOS のバージョンが 15.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：8.3未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：12.1未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E3" ] }, { "text": "「watchOS / iOS and iPadOS / macOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-30952", "https://support.apple.com/en-us/HT212975", "https://support.apple.com/en-us/HT212976", "https://support.apple.com/en-us/HT212978", "https://support.apple.com/en-us/HT212980", "https://support.apple.com/en-us/HT212982", "http://www.openwall.com/lists/oss-security/2022/01/21/2", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "https://www.debian.org/security/2022/dsa-5061", "https://www.debian.org/security/2022/dsa-5060", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952" ] } ], "actions": [ { "text": "この問題は tvOS 15.2、macOS Monterey 12.1、Safari 15.2、iOS 15.2、iPadOS 15.2、watchOS 8.3 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-30952", "https://support.apple.com/en-us/HT212975", "https://support.apple.com/en-us/HT212976", "https://support.apple.com/en-us/HT212978", "https://support.apple.com/en-us/HT212980", "https://support.apple.com/en-us/HT212982", "http://www.openwall.com/lists/oss-security/2022/01/21/2", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "https://www.debian.org/security/2022/dsa-5061", "https://www.debian.org/security/2022/dsa-5060", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-30952", "https://support.apple.com/en-us/HT212975", "https://support.apple.com/en-us/HT212976", "https://support.apple.com/en-us/HT212978", "https://support.apple.com/en-us/HT212980", "https://support.apple.com/en-us/HT212982", "http://www.openwall.com/lists/oss-security/2022/01/21/2", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "https://www.debian.org/security/2022/dsa-5061", "https://www.debian.org/security/2022/dsa-5060", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-30952", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT212975", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212976", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212978", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212980", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT212982", "label": "CISAが示す関連情報" }, { "url": "http://www.openwall.com/lists/oss-security/2022/01/21/2", "label": "[oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/", "label": "FEDORA-2022-25a98f5d55" }, { "url": "https://www.debian.org/security/2022/dsa-5061", "label": "DSA-5061" }, { "url": "https://www.debian.org/security/2022/dsa-5060", "label": "DSA-5060" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/", "label": "FEDORA-2022-f7366e60cb" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"description\":\"Processing maliciously crafted web content may lead to arbitrary code execution\",\"lang\":\"en\",\"type\":\"text\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"watchOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"8.3\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"iOS and iPadOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"12.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/30xxx/CVE-2021-30952.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"product\":\"macOS\",\"vendor\":\"Apple\",\"versions\":[{\"lessThan\":\"15.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-30952\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-30952（watchOS / iOS and iPadOS / macOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・watchOS のバージョンが 8.3 未満は影響を受けます。\n・iOS および iPadOS のバージョンが 15.2 未満は影響を受けます。\n・macOS のバージョンが 12.1 未満は影響を受けます。\n・macOS のバージョンが 15.2 未満は影響を受けます。\n・公式の対象表：Apple / watchOS。影響ありとして記載：8.3未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：12.1未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：15.2未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-30952", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:39.604Z", "lastSuccess": "2026-10-23T03:24:39.604Z", "sourceCheckedAt": "2026-10-23T02:43:17.353Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-41974", "aliases": [], "title": "iOS and iPadOS：コード実行", "summary": "メモリ管理の改善により、使用後解放（use‑after‑free）問題が修正されました。この問題は iOS 17、iPadOS 17、iOS 15.8.7、iPadOS 15.8.7 で修正されています。アプリがカーネル権限で任意のコードを実行できる可能性があります。", "risk": "アプリがカーネル権限で任意のコードを実行できる可能性があります。", "product": "iOS and iPadOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": ">= unspecified / < 17" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.8.7" } ], "fixed": [], "steps": [ "この問題は iOS 17、iPadOS 17、iOS 15.8.7、iPadOS 15.8.7 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-41974", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/120949", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/126632", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213938", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213938", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41974", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-01-10T22:03:23.430Z", "modifiedAt": "2026-03-12T00:52:05.981Z", "fetchedAt": "2026-10-23T02:43:28.400Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "17", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.8.7", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-41974", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "fetchedAt": "2026-10-23T02:43:28.400Z", "publishedAt": "2024-01-10T22:03:23.430Z", "modifiedAt": "2026-03-12T00:52:05.981Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "17", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "15.8.7", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "An app may be able to execute arbitrary code with kernel privileges", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/120949", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/126632", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/HT213938", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/kb/HT213938", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41974", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"17\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.8.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"An app may be able to execute arbitrary code with kernel privileges\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-12T00:52:05.981Z", "fetchedAt": "2026-10-23T02:43:28.400Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-05T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:39.825Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a6e4eb4a36ad45c7856b511ec1beab63458749661139010d42a1dd28d60ee104", "sourceModifiedAt": "2026-03-12T00:52:05.981Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ管理の改善により、使用後解放（use‑after‑free）問題が修正されました。この問題は iOS 17、iPadOS 17、iOS 15.8.7、iPadOS 15.8.7 で修正されています。アプリがカーネル権限で任意のコードを実行できる可能性があります。", "risk": "アプリがカーネル権限で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "iOS および iPadOS のバージョンが 17 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E3" ] }, { "text": "iOS および iPadOS のバージョンが 15.8.7 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：17未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E3" ] }, { "text": "「iOS and iPadOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-41974", "https://support.apple.com/en-us/120949", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "https://support.apple.com/en-us/HT213938", "https://support.apple.com/kb/HT213938", "https://nvd.nist.gov/vuln/detail/CVE-2023-41974" ] } ], "actions": [ { "text": "この問題は iOS 17、iPadOS 17、iOS 15.8.7、iPadOS 15.8.7 で修正されています。", "kind": "fix", "evidenceIds": [ "E1", "E2" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-41974", "https://support.apple.com/en-us/120949", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "https://support.apple.com/en-us/HT213938", "https://support.apple.com/kb/HT213938", "https://nvd.nist.gov/vuln/detail/CVE-2023-41974" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-41974", "https://support.apple.com/en-us/120949", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "https://support.apple.com/en-us/HT213938", "https://support.apple.com/kb/HT213938", "https://nvd.nist.gov/vuln/detail/CVE-2023-41974" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-41974", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/120949", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/126632", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213938", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213938", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41974", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"An app may be able to execute arbitrary code with kernel privileges\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"17\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/41xxx/CVE-2023-41974.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.8.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41974", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-41974\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-41974（iOS and iPadOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・iOS および iPadOS のバージョンが 17 未満のものは影響を受けます。\n・iOS および iPadOS のバージョンが 15.8.7 未満のものは影響を受けます。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：17未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.7未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-41974", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:39.825Z", "lastSuccess": "2026-10-23T03:24:39.825Z", "sourceCheckedAt": "2026-10-23T02:43:28.400Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-43000", "aliases": [], "title": "macOS / iOS and iPadOS / Safari：脆弱性情報", "summary": "メモリ管理の改善により、使用後解放（use‑after‑free）問題が修正されました。この問題は macOS Ventura 13.5、iOS 16.6、iPadOS 16.6、Safari 16.6、iOS 15.8.7、iPadOS 15.8.7 で修正されています。悪意のある Web コンテンツを処理するとメモリ破損が起こる可能性があります。", "risk": "悪意のある Web コンテンツを処理するとメモリ破損が起こる可能性があります。", "product": "macOS / iOS and iPadOS / Safari", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "macOS", "range": ">= unspecified / < 13.5" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 16.6" }, { "product": "Safari", "range": ">= unspecified / < 16.6" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.8.7" } ], "fixed": [], "steps": [ "この問題は macOS Ventura 13.5、iOS 16.6、iPadOS 16.6、Safari 16.6、iOS 15.8.7、iPadOS 15.8.7 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-43000", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/120331", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/120338", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/120324", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126632", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43000", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-11-05T18:33:23.777Z", "modifiedAt": "2026-09-21T19:03:00.605Z", "fetchedAt": "2026-10-23T02:43:28.666Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "13.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.6", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "Safari", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.6", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.8.7", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-43000", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "fetchedAt": "2026-10-23T02:43:28.666Z", "publishedAt": "2025-11-05T18:33:23.777Z", "modifiedAt": "2026-09-21T19:03:00.605Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "13.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "16.6", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "Safari", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "16.6", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "15.8.7", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing maliciously crafted web content may lead to memory corruption", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/120331", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/120338", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/120324", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/126632", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.8.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Processing maliciously crafted web content may lead to memory corruption\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T19:03:00.605Z", "fetchedAt": "2026-10-23T02:43:28.666Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-05T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "macOS / iOS and iPadOS / Safariに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:40.223Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "47b8f50e6c4a84baef3cfe60d897c7ea9daf214579af9ce022bf300146108a13", "sourceModifiedAt": "2026-09-21T19:03:00.605Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ管理の改善により、使用後解放（use‑after‑free）問題が修正されました。この問題は macOS Ventura 13.5、iOS 16.6、iPadOS 16.6、Safari 16.6、iOS 15.8.7、iPadOS 15.8.7 で修正されています。悪意のある Web コンテンツを処理するとメモリ破損が起こる可能性があります。", "risk": "悪意のある Web コンテンツを処理するとメモリ破損が起こる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "macOS のバージョンが 13.5 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E3" ] }, { "text": "iOS および iPadOS のバージョンが 16.6 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E4" ] }, { "text": "Safari のバージョンが 16.6 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E5" ] }, { "text": "iOS および iPadOS のバージョンが 15.8.7 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：13.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.6未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / Safari。影響ありとして記載：16.6未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E6" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E3" ] }, { "text": "「macOS / iOS and iPadOS / Safari」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-43000", "https://support.apple.com/en-us/120331", "https://support.apple.com/en-us/120338", "https://support.apple.com/en-us/120324", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "https://nvd.nist.gov/vuln/detail/CVE-2023-43000" ] } ], "actions": [ { "text": "この問題は macOS Ventura 13.5、iOS 16.6、iPadOS 16.6、Safari 16.6、iOS 15.8.7、iPadOS 15.8.7 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-43000", "https://support.apple.com/en-us/120331", "https://support.apple.com/en-us/120338", "https://support.apple.com/en-us/120324", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "https://nvd.nist.gov/vuln/detail/CVE-2023-43000" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-43000", "https://support.apple.com/en-us/120331", "https://support.apple.com/en-us/120338", "https://support.apple.com/en-us/120324", "https://support.apple.com/en-us/126632", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "https://nvd.nist.gov/vuln/detail/CVE-2023-43000" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-43000", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/120331", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/120338", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/120324", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126632", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43000", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"Processing maliciously crafted web content may lead to memory corruption\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43000.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.8.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43000", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-43000\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-43000（macOS / iOS and iPadOS / Safari）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・macOS のバージョンが 13.5 未満は影響を受けます。\n・iOS および iPadOS のバージョンが 16.6 未満は影響を受けます。\n・Safari のバージョンが 16.6 未満は影響を受けます。\n・iOS および iPadOS のバージョンが 15.8.7 未満は影響を受けます。\n・公式の対象表：Apple / macOS。影響ありとして記載：13.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.6未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / Safari。影響ありとして記載：16.6未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.7未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-43000", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:40.223Z", "lastSuccess": "2026-10-23T03:24:40.223Z", "sourceCheckedAt": "2026-10-23T02:43:28.666Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-21385", "aliases": [], "title": "Snapdragon：脆弱性情報", "summary": "整数オーバーフローまたはラップアラウンドがグラフィックスで発生し、メモリ割り当てのアラインメント使用時にメモリ破損が起こります。", "risk": "メモリ破損が発生する可能性があります。", "product": "Snapdragon", "category": "other", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "qualcomm", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Snapdragon", "range": "5G Fixed Wireless Access Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "APQ8098（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "AR8031（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "AR8035（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "C-V2X 9150（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "CSRA6620（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "CSRA6640（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FastConnect 6200（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FastConnect 6700（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FastConnect 6800（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FastConnect 6900（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FastConnect 7800（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Flight RB5 5G Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "FSM100 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "G1 Gen 1（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "G2 Gen 1（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "IQ6 Series Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "IQ8 Series Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "IQ9 Series Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "LeMans_AU_LGIT（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "LeMansAU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "MDM9250（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "MDM9628（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Milos（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Monaco_IOT（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Netrani（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Orne（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Palawan25（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Pandeiro（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QAM8255P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QAM8295P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QAMSRV1H（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QAMSRV1M（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA2066（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6174A（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6391（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6564A（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6564AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6574（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6574A（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6574AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6584AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6595（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6595AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6678AQ（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6688AQ（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6696（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6698AQ（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6698AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA6797AQ（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA8081（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA8337（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA8695AU（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA9367（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCA9377（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM2290（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM4325（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM4490（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM5430（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM6125（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCM6490（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCN6024（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCN9011（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCN9012（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCN9024（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCS2290（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCS4290（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCS4490（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QCS8550（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QLN1083BD（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QLN1086BD（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QMP1000（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QPA1083BD（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QPA1086BD（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QRB5165M（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QRB5165N（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Qualcomm 215 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Qualcomm Video Collaboration VC1 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Qualcomm Video Collaboration VC3 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Qualcomm Video Collaboration VC5 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1083（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1086（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1093（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1094（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1095（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "QXM1096（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Robotics RB2 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Robotics RB5 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA4150P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA4155P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA6145P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA6150P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA6155（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA6155P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA7255P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA7775P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8145P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8150P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8155（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8155P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8195P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8255P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8295P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8620P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA8770P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SA9000P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SAR1165P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SAR1250P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SAR2130P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SAR2230P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SC8380XP（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SD 8 Gen1 5G（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SD626（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SD662（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SD865 5G（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SDA660（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SDM429W（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SDX61（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM6225P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM6650P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7325P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7435（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7550（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7550P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7635P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7675（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM7675P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8475P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8550P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8635（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8635P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8650Q（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SM8750P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Smart Audio 400 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Smart Display 200 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 4 Gen 1 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 4 Gen 2 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 429 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 460 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 480 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 480+ 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 6 Gen 1 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 6 Gen 3 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 6 Gen 4 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 625 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 626 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 660 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 662 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 680 4G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 685 4G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 690 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 695 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 7 Gen 1 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 7+ Gen 2 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 778G 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 778G+ 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 782G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 7c+ Gen 3 Compute（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 7s Gen 3 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8 Elite（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8 Elite Gen 5（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8 Gen 1 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8 Gen 2 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8 Gen 3 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8+ Gen 1 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 8+ Gen 2 Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 820 Automotive Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 820Am（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 865 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 865+ 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 870 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 888 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon 888+ 5G Mobile Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon AR1 Gen 1 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon AR1+ Gen 1 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon Auto 5G Modem-RF（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon W5+ Gen 1 Wearable Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon X12 LTE Modem（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon X5 LTE Modem（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon X53 5G Modem-RF System（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon X55 5G Modem-RF System（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon X65 5G Modem-RF System（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon XR2 5G Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Snapdragon XR2+ Gen 1 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SRV1H（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SRV1M（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SW5100（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SW5100P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SW6100（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SW6100P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SXR2230P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SXR2250P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SXR2330P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "SXR2350P（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Themisto（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Vision Intelligence 100 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Vision Intelligence 200 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "Vision Intelligence 400 Platform（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9326（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9330（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9335（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9341（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9360（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9370（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9371（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9375（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9378（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9380（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9385（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9390（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCD9395（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3615（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3620（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3660B（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3680B（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3910（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3950（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3980（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3988（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN3990（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN6450（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN6650（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN6755（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN7860（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN7861（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN7880（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WCN7881（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8810（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8815（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8830（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8832（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8835（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8840（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8845（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" }, { "product": "Snapdragon", "range": "WSA8845H（環境: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "label": "CVE：qualcomm" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21385", "label": "CVE公式レコード" }, { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "label": "CVE掲載の参考情報" }, { "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21385", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-03-02T16:53:59.406Z", "modifiedAt": "2026-03-04T04:55:16.033Z", "fetchedAt": "2026-10-23T02:43:47.622Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Memory corruption while using alignments for memory allocation.", "sourceTitle": "Integer Overflow or Wraparound in Graphics", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "Snapdragon Auto", "Snapdragon CCW", "Snapdragon Compute", "Snapdragon Connectivity", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile", "Snapdragon Voice & Music", "Snapdragon WBC", "Snapdragon Wearables" ], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [ { "status": "affected", "version": "5G Fixed Wireless Access Platform" }, { "status": "affected", "version": "APQ8098" }, { "status": "affected", "version": "AR8031" }, { "status": "affected", "version": "AR8035" }, { "status": "affected", "version": "C-V2X 9150" }, { "status": "affected", "version": "CSRA6620" }, { "status": "affected", "version": "CSRA6640" }, { "status": "affected", "version": "FastConnect 6200" }, { "status": "affected", "version": "FastConnect 6700" }, { "status": "affected", "version": "FastConnect 6800" }, { "status": "affected", "version": "FastConnect 6900" }, { "status": "affected", "version": "FastConnect 7800" }, { "status": "affected", "version": "Flight RB5 5G Platform" }, { "status": "affected", "version": "FSM100 Platform" }, { "status": "affected", "version": "G1 Gen 1" }, { "status": "affected", "version": "G2 Gen 1" }, { "status": "affected", "version": "IQ6 Series Platform" }, { "status": "affected", "version": "IQ8 Series Platform" }, { "status": "affected", "version": "IQ9 Series Platform" }, { "status": "affected", "version": "LeMans_AU_LGIT" }, { "status": "affected", "version": "LeMansAU" }, { "status": "affected", "version": "MDM9250" }, { "status": "affected", "version": "MDM9628" }, { "status": "affected", "version": "Milos" }, { "status": "affected", "version": "Monaco_IOT" }, { "status": "affected", "version": "Netrani" }, { "status": "affected", "version": "Orne" }, { "status": "affected", "version": "Palawan25" }, { "status": "affected", "version": "Pandeiro" }, { "status": "affected", "version": "QAM8255P" }, { "status": "affected", "version": "QAM8295P" }, { "status": "affected", "version": "QAMSRV1H" }, { "status": "affected", "version": "QAMSRV1M" }, { "status": "affected", "version": "QCA2066" }, { "status": "affected", "version": "QCA6174A" }, { "status": "affected", "version": "QCA6391" }, { "status": "affected", "version": "QCA6564A" }, { "status": "affected", "version": "QCA6564AU" }, { "status": "affected", "version": "QCA6574" }, { "status": "affected", "version": "QCA6574A" }, { "status": "affected", "version": "QCA6574AU" }, { "status": "affected", "version": "QCA6584AU" }, { "status": "affected", "version": "QCA6595" }, { "status": "affected", "version": "QCA6595AU" }, { "status": "affected", "version": "QCA6678AQ" }, { "status": "affected", "version": "QCA6688AQ" }, { "status": "affected", "version": "QCA6696" }, { "status": "affected", "version": "QCA6698AQ" }, { "status": "affected", "version": "QCA6698AU" }, { "status": "affected", "version": "QCA6797AQ" }, { "status": "affected", "version": "QCA8081" }, { "status": "affected", "version": "QCA8337" }, { "status": "affected", "version": "QCA8695AU" }, { "status": "affected", "version": "QCA9367" }, { "status": "affected", "version": "QCA9377" }, { "status": "affected", "version": "QCM2290" }, { "status": "affected", "version": "QCM4325" }, { "status": "affected", "version": "QCM4490" }, { "status": "affected", "version": "QCM5430" }, { "status": "affected", "version": "QCM6125" }, { "status": "affected", "version": "QCM6490" }, { "status": "affected", "version": "QCN6024" }, { "status": "affected", "version": "QCN9011" }, { "status": "affected", "version": "QCN9012" }, { "status": "affected", "version": "QCN9024" }, { "status": "affected", "version": "QCS2290" }, { "status": "affected", "version": "QCS4290" }, { "status": "affected", "version": "QCS4490" }, { "status": "affected", "version": "QCS8550" }, { "status": "affected", "version": "QLN1083BD" }, { "status": "affected", "version": "QLN1086BD" }, { "status": "affected", "version": "QMP1000" }, { "status": "affected", "version": "QPA1083BD" }, { "status": "affected", "version": "QPA1086BD" }, { "status": "affected", "version": "QRB5165M" }, { "status": "affected", "version": "QRB5165N" }, { "status": "affected", "version": "Qualcomm 215 Mobile Platform" }, { "status": "affected", "version": "Qualcomm Video Collaboration VC1 Platform" }, { "status": "affected", "version": "Qualcomm Video Collaboration VC3 Platform" }, { "status": "affected", "version": "Qualcomm Video Collaboration VC5 Platform" }, { "status": "affected", "version": "QXM1083" }, { "status": "affected", "version": "QXM1086" }, { "status": "affected", "version": "QXM1093" }, { "status": "affected", "version": "QXM1094" }, { "status": "affected", "version": "QXM1095" }, { "status": "affected", "version": "QXM1096" }, { "status": "affected", "version": "Robotics RB2 Platform" }, { "status": "affected", "version": "Robotics RB5 Platform" }, { "status": "affected", "version": "SA4150P" }, { "status": "affected", "version": "SA4155P" }, { "status": "affected", "version": "SA6145P" }, { "status": "affected", "version": "SA6150P" }, { "status": "affected", "version": "SA6155" }, { "status": "affected", "version": "SA6155P" }, { "status": "affected", "version": "SA7255P" }, { "status": "affected", "version": "SA7775P" }, { "status": "affected", "version": "SA8145P" }, { "status": "affected", "version": "SA8150P" }, { "status": "affected", "version": "SA8155" }, { "status": "affected", "version": "SA8155P" }, { "status": "affected", "version": "SA8195P" }, { "status": "affected", "version": "SA8255P" }, { "status": "affected", "version": "SA8295P" }, { "status": "affected", "version": "SA8620P" }, { "status": "affected", "version": "SA8770P" }, { "status": "affected", "version": "SA9000P" }, { "status": "affected", "version": "SAR1165P" }, { "status": "affected", "version": "SAR1250P" }, { "status": "affected", "version": "SAR2130P" }, { "status": "affected", "version": "SAR2230P" }, { "status": "affected", "version": "SC8380XP" }, { "status": "affected", "version": "SD 8 Gen1 5G" }, { "status": "affected", "version": "SD626" }, { "status": "affected", "version": "SD662" }, { "status": "affected", "version": "SD865 5G" }, { "status": "affected", "version": "SDA660" }, { "status": "affected", "version": "SDM429W" }, { "status": "affected", "version": "SDX61" }, { "status": "affected", "version": "SM6225P" }, { "status": "affected", "version": "SM6650P" }, { "status": "affected", "version": "SM7325P" }, { "status": "affected", "version": "SM7435" }, { "status": "affected", "version": "SM7550" }, { "status": "affected", "version": "SM7550P" }, { "status": "affected", "version": "SM7635P" }, { "status": "affected", "version": "SM7675" }, { "status": "affected", "version": "SM7675P" }, { "status": "affected", "version": "SM8475P" }, { "status": "affected", "version": "SM8550P" }, { "status": "affected", "version": "SM8635" }, { "status": "affected", "version": "SM8635P" }, { "status": "affected", "version": "SM8650Q" }, { "status": "affected", "version": "SM8750P" }, { "status": "affected", "version": "Smart Audio 400 Platform" }, { "status": "affected", "version": "Smart Display 200 Platform" }, { "status": "affected", "version": "Snapdragon 4 Gen 1 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 4 Gen 2 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 429 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 460 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 480 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 480+ 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 6 Gen 1 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 6 Gen 3 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 6 Gen 4 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 625 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 626 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 660 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 662 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 680 4G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 685 4G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 690 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 695 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 7 Gen 1 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 7+ Gen 2 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 778G 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 778G+ 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 782G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 7c+ Gen 3 Compute" }, { "status": "affected", "version": "Snapdragon 7s Gen 3 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 8 Elite" }, { "status": "affected", "version": "Snapdragon 8 Elite Gen 5" }, { "status": "affected", "version": "Snapdragon 8 Gen 1 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 8 Gen 2 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 8 Gen 3 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 8+ Gen 1 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 8+ Gen 2 Mobile Platform" }, { "status": "affected", "version": "Snapdragon 820 Automotive Platform" }, { "status": "affected", "version": "Snapdragon 820Am" }, { "status": "affected", "version": "Snapdragon 865 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 865+ 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 870 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 888 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon 888+ 5G Mobile Platform" }, { "status": "affected", "version": "Snapdragon AR1 Gen 1 Platform" }, { "status": "affected", "version": "Snapdragon AR1+ Gen 1 Platform" }, { "status": "affected", "version": "Snapdragon Auto 5G Modem-RF" }, { "status": "affected", "version": "Snapdragon W5+ Gen 1 Wearable Platform" }, { "status": "affected", "version": "Snapdragon X12 LTE Modem" }, { "status": "affected", "version": "Snapdragon X5 LTE Modem" }, { "status": "affected", "version": "Snapdragon X53 5G Modem-RF System" }, { "status": "affected", "version": "Snapdragon X55 5G Modem-RF System" }, { "status": "affected", "version": "Snapdragon X65 5G Modem-RF System" }, { "status": "affected", "version": "Snapdragon XR2 5G Platform" }, { "status": "affected", "version": "Snapdragon XR2+ Gen 1 Platform" }, { "status": "affected", "version": "SRV1H" }, { "status": "affected", "version": "SRV1M" }, { "status": "affected", "version": "SW5100" }, { "status": "affected", "version": "SW5100P" }, { "status": "affected", "version": "SW6100" }, { "status": "affected", "version": "SW6100P" }, { "status": "affected", "version": "SXR2230P" }, { "status": "affected", "version": "SXR2250P" }, { "status": "affected", "version": "SXR2330P" }, { "status": "affected", "version": "SXR2350P" }, { "status": "affected", "version": "Themisto" }, { "status": "affected", "version": "Vision Intelligence 100 Platform" }, { "status": "affected", "version": "Vision Intelligence 200 Platform" }, { "status": "affected", "version": "Vision Intelligence 400 Platform" }, { "status": "affected", "version": "WCD9326" }, { "status": "affected", "version": "WCD9330" }, { "status": "affected", "version": "WCD9335" }, { "status": "affected", "version": "WCD9341" }, { "status": "affected", "version": "WCD9360" }, { "status": "affected", "version": "WCD9370" }, { "status": "affected", "version": "WCD9371" }, { "status": "affected", "version": "WCD9375" }, { "status": "affected", "version": "WCD9378" }, { "status": "affected", "version": "WCD9380" }, { "status": "affected", "version": "WCD9385" }, { "status": "affected", "version": "WCD9390" }, { "status": "affected", "version": "WCD9395" }, { "status": "affected", "version": "WCN3615" }, { "status": "affected", "version": "WCN3620" }, { "status": "affected", "version": "WCN3660B" }, { "status": "affected", "version": "WCN3680B" }, { "status": "affected", "version": "WCN3910" }, { "status": "affected", "version": "WCN3950" }, { "status": "affected", "version": "WCN3980" }, { "status": "affected", "version": "WCN3988" }, { "status": "affected", "version": "WCN3990" }, { "status": "affected", "version": "WCN6450" }, { "status": "affected", "version": "WCN6650" }, { "status": "affected", "version": "WCN6755" }, { "status": "affected", "version": "WCN7860" }, { "status": "affected", "version": "WCN7861" }, { "status": "affected", "version": "WCN7880" }, { "status": "affected", "version": "WCN7881" }, { "status": "affected", "version": "WSA8810" }, { "status": "affected", "version": "WSA8815" }, { "status": "affected", "version": "WSA8830" }, { "status": "affected", "version": "WSA8832" }, { "status": "affected", "version": "WSA8835" }, { "status": "affected", "version": "WSA8840" }, { "status": "affected", "version": "WSA8845" }, { "status": "affected", "version": "WSA8845H" } ] } ], "configurationNotes": "対象環境・機能: Snapdragon Auto / Snapdragon CCW / Snapdragon Compute / Snapdragon Connectivity / Snapdragon Consumer IOT / Snapdragon Industrial IOT / Snapdragon Mobile / Snapdragon Voice & Music / Snapdragon WBC / Snapdragon Wearables。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-21385", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "fetchedAt": "2026-10-23T02:43:47.622Z", "publishedAt": "2026-03-02T16:53:59.406Z", "modifiedAt": "2026-03-04T04:55:16.033Z", "state": "published", "provider": "qualcomm", "title": "Integer Overflow or Wraparound in Graphics", "descriptions": [ { "lang": "en", "value": "Memory corruption while using alignments for memory allocation.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Qualcomm, Inc.", "product": "Snapdragon", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "Snapdragon Auto", "Snapdragon CCW", "Snapdragon Compute", "Snapdragon Connectivity", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile", "Snapdragon Voice & Music", "Snapdragon WBC", "Snapdragon Wearables" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5G Fixed Wireless Access Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "APQ8098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "AR8031", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "AR8035", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "C-V2X 9150", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "CSRA6620", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "CSRA6640", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "FastConnect 6200", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "FastConnect 6700", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "FastConnect 6800", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "FastConnect 6900", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "FastConnect 7800", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "Flight RB5 5G Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "FSM100 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "G1 Gen 1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "G2 Gen 1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "IQ6 Series Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "IQ8 Series Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "IQ9 Series Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "LeMans_AU_LGIT", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "LeMansAU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "MDM9250", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "MDM9628", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "Milos", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "Monaco_IOT", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "Netrani", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "Orne", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "Palawan25", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "Pandeiro", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "QAM8255P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "QAM8295P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "QAMSRV1H", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "QAMSRV1M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "QCA2066", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "QCA6174A", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "QCA6391", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "QCA6564A", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "QCA6564AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "QCA6574", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "QCA6574A", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "QCA6574AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "QCA6584AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "QCA6595", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "QCA6595AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "QCA6678AQ", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "QCA6688AQ", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "QCA6696", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "QCA6698AQ", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "QCA6698AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "QCA6797AQ", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "QCA8081", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "QCA8337", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "QCA8695AU", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "QCA9367", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "QCA9377", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "QCM2290", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "QCM4325", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "QCM4490", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "QCM5430", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "QCM6125", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "QCM6490", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "QCN6024", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "QCN9011", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "QCN9012", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "QCN9024", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "QCS2290", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "QCS4290", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "QCS4490", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "QCS8550", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "QLN1083BD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "QLN1086BD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "QMP1000", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "QPA1083BD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "QPA1086BD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "QRB5165M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "QRB5165N", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "Qualcomm 215 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "Qualcomm Video Collaboration VC1 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "Qualcomm Video Collaboration VC3 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "Qualcomm Video Collaboration VC5 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "QXM1083", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "QXM1086", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "QXM1093", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "QXM1094", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "QXM1095", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "QXM1096", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "Robotics RB2 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "Robotics RB5 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "SA4150P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "SA4155P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "SA6145P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "SA6150P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "SA6155", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "SA6155P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "SA7255P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "SA7775P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "SA8145P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "SA8150P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "SA8155", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "SA8155P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "SA8195P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "SA8255P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "SA8295P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "SA8620P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "SA8770P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "SA9000P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "SAR1165P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "SAR1250P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "SAR2130P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "SAR2230P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "SC8380XP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "SD 8 Gen1 5G", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "SD626", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "SD662", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "SD865 5G", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "SDA660", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "SDM429W", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "SDX61", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "SM6225P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "SM6650P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "SM7325P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "SM7435", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "SM7550", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "SM7550P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "SM7635P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "SM7675", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "SM7675P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "SM8475P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "SM8550P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/129", "version": "SM8635", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/130", "version": "SM8635P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/131", "version": "SM8650Q", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/132", "version": "SM8750P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/133", "version": "Smart Audio 400 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/134", "version": "Smart Display 200 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/135", "version": "Snapdragon 4 Gen 1 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/136", "version": "Snapdragon 4 Gen 2 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/137", "version": "Snapdragon 429 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/138", "version": "Snapdragon 460 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/139", "version": "Snapdragon 480 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/140", "version": "Snapdragon 480+ 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/141", "version": "Snapdragon 6 Gen 1 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/142", "version": "Snapdragon 6 Gen 3 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/143", "version": "Snapdragon 6 Gen 4 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/144", "version": "Snapdragon 625 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/145", "version": "Snapdragon 626 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/146", "version": "Snapdragon 660 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/147", "version": "Snapdragon 662 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/148", "version": "Snapdragon 680 4G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/149", "version": "Snapdragon 685 4G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/150", "version": "Snapdragon 690 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/151", "version": "Snapdragon 695 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/152", "version": "Snapdragon 7 Gen 1 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/153", "version": "Snapdragon 7+ Gen 2 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/154", "version": "Snapdragon 778G 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/155", "version": "Snapdragon 778G+ 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/156", "version": "Snapdragon 782G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/157", "version": "Snapdragon 7c+ Gen 3 Compute", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/158", "version": "Snapdragon 7s Gen 3 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/159", "version": "Snapdragon 8 Elite", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/160", "version": "Snapdragon 8 Elite Gen 5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/161", "version": "Snapdragon 8 Gen 1 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/162", "version": "Snapdragon 8 Gen 2 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/163", "version": "Snapdragon 8 Gen 3 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/164", "version": "Snapdragon 8+ Gen 1 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/165", "version": "Snapdragon 8+ Gen 2 Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/166", "version": "Snapdragon 820 Automotive Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/167", "version": "Snapdragon 820Am", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/168", "version": "Snapdragon 865 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/169", "version": "Snapdragon 865+ 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/170", "version": "Snapdragon 870 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/171", "version": "Snapdragon 888 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/172", "version": "Snapdragon 888+ 5G Mobile Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/173", "version": "Snapdragon AR1 Gen 1 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/174", "version": "Snapdragon AR1+ Gen 1 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/175", "version": "Snapdragon Auto 5G Modem-RF", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/176", "version": "Snapdragon W5+ Gen 1 Wearable Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/177", "version": "Snapdragon X12 LTE Modem", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/178", "version": "Snapdragon X5 LTE Modem", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/179", "version": "Snapdragon X53 5G Modem-RF System", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/180", "version": "Snapdragon X55 5G Modem-RF System", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/181", "version": "Snapdragon X65 5G Modem-RF System", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/182", "version": "Snapdragon XR2 5G Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/183", "version": "Snapdragon XR2+ Gen 1 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/184", "version": "SRV1H", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/185", "version": "SRV1M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/186", "version": "SW5100", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/187", "version": "SW5100P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/188", "version": "SW6100", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/189", "version": "SW6100P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/190", "version": "SXR2230P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/191", "version": "SXR2250P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/192", "version": "SXR2330P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/193", "version": "SXR2350P", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/194", "version": "Themisto", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/195", "version": "Vision Intelligence 100 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/196", "version": "Vision Intelligence 200 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/197", "version": "Vision Intelligence 400 Platform", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/198", "version": "WCD9326", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/199", "version": "WCD9330", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/200", "version": "WCD9335", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/201", "version": "WCD9341", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/202", "version": "WCD9360", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/203", "version": "WCD9370", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/204", "version": "WCD9371", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/205", "version": "WCD9375", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/206", "version": "WCD9378", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/207", "version": "WCD9380", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/208", "version": "WCD9385", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/209", "version": "WCD9390", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/210", "version": "WCD9395", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/211", "version": "WCN3615", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/212", "version": "WCN3620", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/213", "version": "WCN3660B", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/214", "version": "WCN3680B", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/215", "version": "WCN3910", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/216", "version": "WCN3950", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/217", "version": "WCN3980", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/218", "version": "WCN3988", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/219", "version": "WCN3990", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/220", "version": "WCN6450", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/221", "version": "WCN6650", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/222", "version": "WCN6755", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/223", "version": "WCN7860", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/224", "version": "WCN7861", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/225", "version": "WCN7880", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/226", "version": "WCN7881", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/227", "version": "WSA8810", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/228", "version": "WSA8815", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/229", "version": "WSA8830", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/230", "version": "WSA8832", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/231", "version": "WSA8835", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/232", "version": "WSA8840", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/233", "version": "WSA8845", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/234", "version": "WSA8845H", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "qualcomm", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "label": "qualcomm", "tags": [], "provider": "qualcomm", "sourcePath": "/containers/cna/references/0" }, { "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21385", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"Snapdragon Auto\",\"Snapdragon CCW\",\"Snapdragon Compute\",\"Snapdragon Connectivity\",\"Snapdragon Consumer IOT\",\"Snapdragon Industrial IOT\",\"Snapdragon Mobile\",\"Snapdragon Voice & Music\",\"Snapdragon WBC\",\"Snapdragon Wearables\"],\"product\":\"Snapdragon\",\"vendor\":\"Qualcomm, Inc.\",\"versions\":[{\"status\":\"affected\",\"version\":\"5G Fixed Wireless Access Platform\"},{\"status\":\"affected\",\"version\":\"APQ8098\"},{\"status\":\"affected\",\"version\":\"AR8031\"},{\"status\":\"affected\",\"version\":\"AR8035\"},{\"status\":\"affected\",\"version\":\"C-V2X 9150\"},{\"status\":\"affected\",\"version\":\"CSRA6620\"},{\"status\":\"affected\",\"version\":\"CSRA6640\"},{\"status\":\"affected\",\"version\":\"FastConnect 6200\"},{\"status\":\"affected\",\"version\":\"FastConnect 6700\"},{\"status\":\"affected\",\"version\":\"FastConnect 6800\"},{\"status\":\"affected\",\"version\":\"FastConnect 6900\"},{\"status\":\"affected\",\"version\":\"FastConnect 7800\"},{\"status\":\"affected\",\"version\":\"Flight RB5 5G Platform\"},{\"status\":\"affected\",\"version\":\"FSM100 Platform\"},{\"status\":\"affected\",\"version\":\"G1 Gen 1\"},{\"status\":\"affected\",\"version\":\"G2 Gen 1\"},{\"status\":\"affected\",\"version\":\"IQ6 Series Platform\"},{\"status\":\"affected\",\"version\":\"IQ8 Series Platform\"},{\"status\":\"affected\",\"version\":\"IQ9 Series Platform\"},{\"status\":\"affected\",\"version\":\"LeMans_AU_LGIT\"},{\"status\":\"affected\",\"version\":\"LeMansAU\"},{\"status\":\"affected\",\"version\":\"MDM9250\"},{\"status\":\"affected\",\"version\":\"MDM9628\"},{\"status\":\"affected\",\"version\":\"Milos\"},{\"status\":\"affected\",\"version\":\"Monaco_IOT\"},{\"status\":\"affected\",\"version\":\"Netrani\"},{\"status\":\"affected\",\"version\":\"Orne\"},{\"status\":\"affected\",\"version\":\"Palawan25\"},{\"status\":\"affected\",\"version\":\"Pandeiro\"},{\"status\":\"affected\",\"version\":\"QAM8255P\"},{\"status\":\"affected\",\"version\":\"QAM8295P\"},{\"status\":\"affected\",\"version\":\"QAMSRV1H\"},{\"status\":\"affected\",\"version\":\"QAMSRV1M\"},{\"status\":\"affected\",\"version\":\"QCA2066\"},{\"status\":\"affected\",\"version\":\"QCA6174A\"},{\"status\":\"affected\",\"version\":\"QCA6391\"},{\"status\":\"affected\",\"version\":\"QCA6564A\"},{\"status\":\"affected\",\"version\":\"QCA6564AU\"},{\"status\":\"affected\",\"version\":\"QCA6574\"},{\"status\":\"affected\",\"version\":\"QCA6574A\"},{\"status\":\"affected\",\"version\":\"QCA6574AU\"},{\"status\":\"affected\",\"version\":\"QCA6584AU\"},{\"status\":\"affected\",\"version\":\"QCA6595\"},{\"status\":\"affected\",\"version\":\"QCA6595AU\"},{\"status\":\"affected\",\"version\":\"QCA6678AQ\"},{\"status\":\"affected\",\"version\":\"QCA6688AQ\"},{\"status\":\"affected\",\"version\":\"QCA6696\"},{\"status\":\"affected\",\"version\":\"QCA6698AQ\"},{\"status\":\"affected\",\"version\":\"QCA6698AU\"},{\"status\":\"affected\",\"version\":\"QCA6797AQ\"},{\"status\":\"affected\",\"version\":\"QCA8081\"},{\"status\":\"affected\",\"version\":\"QCA8337\"},{\"status\":\"affected\",\"version\":\"QCA8695AU\"},{\"status\":\"affected\",\"version\":\"QCA9367\"},{\"status\":\"affected\",\"version\":\"QCA9377\"},{\"status\":\"affected\",\"version\":\"QCM2290\"},{\"status\":\"affected\",\"version\":\"QCM4325\"},{\"status\":\"affected\",\"version\":\"QCM4490\"},{\"status\":\"affected\",\"version\":\"QCM5430\"},{\"status\":\"affected\",\"version\":\"QCM6125\"},{\"status\":\"affected\",\"version\":\"QCM6490\"},{\"status\":\"affected\",\"version\":\"QCN6024\"},{\"status\":\"affected\",\"version\":\"QCN9011\"},{\"status\":\"affected\",\"version\":\"QCN9012\"},{\"status\":\"affected\",\"version\":\"QCN9024\"},{\"status\":\"affected\",\"version\":\"QCS2290\"},{\"status\":\"affected\",\"version\":\"QCS4290\"},{\"status\":\"affected\",\"version\":\"QCS4490\"},{\"status\":\"affected\",\"version\":\"QCS8550\"},{\"status\":\"affected\",\"version\":\"QLN1083BD\"},{\"status\":\"affected\",\"version\":\"QLN1086BD\"},{\"status\":\"affected\",\"version\":\"QMP1000\"},{\"status\":\"affected\",\"version\":\"QPA1083BD\"},{\"status\":\"affected\",\"version\":\"QPA1086BD\"},{\"status\":\"affected\",\"version\":\"QRB5165M\"},{\"status\":\"affected\",\"version\":\"QRB5165N\"},{\"status\":\"affected\",\"version\":\"Qualcomm 215 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC1 Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC3 Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC5 Platform\"},{\"status\":\"affected\",\"version\":\"QXM1083\"},{\"status\":\"affected\",\"version\":\"QXM1086\"},{\"status\":\"affected\",\"version\":\"QXM1093\"},{\"status\":\"affected\",\"version\":\"QXM1094\"},{\"status\":\"affected\",\"version\":\"QXM1095\"},{\"status\":\"affected\",\"version\":\"QXM1096\"},{\"status\":\"affected\",\"version\":\"Robotics RB2 Platform\"},{\"status\":\"affected\",\"version\":\"Robotics RB5 Platform\"},{\"status\":\"affected\",\"version\":\"SA4150P\"},{\"status\":\"affected\",\"version\":\"SA4155P\"},{\"status\":\"affected\",\"version\":\"SA6145P\"},{\"status\":\"affected\",\"version\":\"SA6150P\"},{\"status\":\"affected\",\"version\":\"SA6155\"},{\"status\":\"affected\",\"version\":\"SA6155P\"},{\"status\":\"affected\",\"version\":\"SA7255P\"},{\"status\":\"affected\",\"version\":\"SA7775P\"},{\"status\":\"affected\",\"version\":\"SA8145P\"},{\"status\":\"affected\",\"version\":\"SA8150P\"},{\"status\":\"affected\",\"version\":\"SA8155\"},{\"status\":\"affected\",\"version\":\"SA8155P\"},{\"status\":\"affected\",\"version\":\"SA8195P\"},{\"status\":\"affected\",\"version\":\"SA8255P\"},{\"status\":\"affected\",\"version\":\"SA8295P\"},{\"status\":\"affected\",\"version\":\"SA8620P\"},{\"status\":\"affected\",\"version\":\"SA8770P\"},{\"status\":\"affected\",\"version\":\"SA9000P\"},{\"status\":\"affected\",\"version\":\"SAR1165P\"},{\"status\":\"affected\",\"version\":\"SAR1250P\"},{\"status\":\"affected\",\"version\":\"SAR2130P\"},{\"status\":\"affected\",\"version\":\"SAR2230P\"},{\"status\":\"affected\",\"version\":\"SC8380XP\"},{\"status\":\"affected\",\"version\":\"SD 8 Gen1 5G\"},{\"status\":\"affected\",\"version\":\"SD626\"},{\"status\":\"affected\",\"version\":\"SD662\"},{\"status\":\"affected\",\"version\":\"SD865 5G\"},{\"status\":\"affected\",\"version\":\"SDA660\"},{\"status\":\"affected\",\"version\":\"SDM429W\"},{\"status\":\"affected\",\"version\":\"SDX61\"},{\"status\":\"affected\",\"version\":\"SM6225P\"},{\"status\":\"affected\",\"version\":\"SM6650P\"},{\"status\":\"affected\",\"version\":\"SM7325P\"},{\"status\":\"affected\",\"version\":\"SM7435\"},{\"status\":\"affected\",\"version\":\"SM7550\"},{\"status\":\"affected\",\"version\":\"SM7550P\"},{\"status\":\"affected\",\"version\":\"SM7635P\"},{\"status\":\"affected\",\"version\":\"SM7675\"},{\"status\":\"affected\",\"version\":\"SM7675P\"},{\"status\":\"affected\",\"version\":\"SM8475P\"},{\"status\":\"affected\",\"version\":\"SM8550P\"},{\"status\":\"affected\",\"version\":\"SM8635\"},{\"status\":\"affected\",\"version\":\"SM8635P\"},{\"status\":\"affected\",\"version\":\"SM8650Q\"},{\"status\":\"affected\",\"version\":\"SM8750P\"},{\"status\":\"affected\",\"version\":\"Smart Audio 400 Platform\"},{\"status\":\"affected\",\"version\":\"Smart Display 200 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 4 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 4 Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 429 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 460 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 480 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 480+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 4 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 625 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 626 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 660 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 662 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 680 4G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 685 4G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 690 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 695 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7+ Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 778G 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 778G+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 782G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7c+ Gen 3 Compute\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7s Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Elite\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Elite Gen 5\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8+ Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8+ Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 820 Automotive Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 820Am\"},{\"status\":\"affected\",\"version\":\"Snapdragon 865 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 865+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 870 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 888 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 888+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon AR1 Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon AR1+ Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon Auto 5G Modem-RF\"},{\"status\":\"affected\",\"version\":\"Snapdragon W5+ Gen 1 Wearable Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon X12 LTE Modem\"},{\"status\":\"affected\",\"version\":\"Snapdragon X5 LTE Modem\"},{\"status\":\"affected\",\"version\":\"Snapdragon X53 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon X55 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon X65 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon XR2 5G Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon XR2+ Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"SRV1H\"},{\"status\":\"affected\",\"version\":\"SRV1M\"},{\"status\":\"affected\",\"version\":\"SW5100\"},{\"status\":\"affected\",\"version\":\"SW5100P\"},{\"status\":\"affected\",\"version\":\"SW6100\"},{\"status\":\"affected\",\"version\":\"SW6100P\"},{\"status\":\"affected\",\"version\":\"SXR2230P\"},{\"status\":\"affected\",\"version\":\"SXR2250P\"},{\"status\":\"affected\",\"version\":\"SXR2330P\"},{\"status\":\"affected\",\"version\":\"SXR2350P\"},{\"status\":\"affected\",\"version\":\"Themisto\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 100 Platform\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 200 Platform\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 400 Platform\"},{\"status\":\"affected\",\"version\":\"WCD9326\"},{\"status\":\"affected\",\"version\":\"WCD9330\"},{\"status\":\"affected\",\"version\":\"WCD9335\"},{\"status\":\"affected\",\"version\":\"WCD9341\"},{\"status\":\"affected\",\"version\":\"WCD9360\"},{\"status\":\"affected\",\"version\":\"WCD9370\"},{\"status\":\"affected\",\"version\":\"WCD9371\"},{\"status\":\"affected\",\"version\":\"WCD9375\"},{\"status\":\"affected\",\"version\":\"WCD9378\"},{\"status\":\"affected\",\"version\":\"WCD9380\"},{\"status\":\"affected\",\"version\":\"WCD9385\"},{\"status\":\"affected\",\"version\":\"WCD9390\"},{\"status\":\"affected\",\"version\":\"WCD9395\"},{\"status\":\"affected\",\"version\":\"WCN3615\"},{\"status\":\"affected\",\"version\":\"WCN3620\"},{\"status\":\"affected\",\"version\":\"WCN3660B\"},{\"status\":\"affected\",\"version\":\"WCN3680B\"},{\"status\":\"affected\",\"version\":\"WCN3910\"},{\"status\":\"affected\",\"version\":\"WCN3950\"},{\"status\":\"affected\",\"version\":\"WCN3980\"},{\"status\":\"affected\",\"version\":\"WCN3988\"},{\"status\":\"affected\",\"version\":\"WCN3990\"},{\"status\":\"affected\",\"version\":\"WCN6450\"},{\"status\":\"affected\",\"version\":\"WCN6650\"},{\"status\":\"affected\",\"version\":\"WCN6755\"},{\"status\":\"affected\",\"version\":\"WCN7860\"},{\"status\":\"affected\",\"version\":\"WCN7861\"},{\"status\":\"affected\",\"version\":\"WCN7880\"},{\"status\":\"affected\",\"version\":\"WCN7881\"},{\"status\":\"affected\",\"version\":\"WSA8810\"},{\"status\":\"affected\",\"version\":\"WSA8815\"},{\"status\":\"affected\",\"version\":\"WSA8830\"},{\"status\":\"affected\",\"version\":\"WSA8832\"},{\"status\":\"affected\",\"version\":\"WSA8835\"},{\"status\":\"affected\",\"version\":\"WSA8840\"},{\"status\":\"affected\",\"version\":\"WSA8845\"},{\"status\":\"affected\",\"version\":\"WSA8845H\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Memory corruption while using alignments for memory allocation.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-190\",\"description\":\"CWE-190 Integer Overflow or Wraparound\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"LOCAL\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-04T04:55:16.033Z", "fetchedAt": "2026-10-23T02:43:47.622Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-03T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Snapdragonに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:42.210Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "62b22c57453579f0d8c587201d4896eab143f64262d0384d06ab7c7997f6feb7", "sourceModifiedAt": "2026-03-04T04:55:16.033Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "整数オーバーフローまたはラップアラウンドがグラフィックスで発生し、メモリ割り当てのアラインメント使用時にメモリ破損が起こります。", "risk": "メモリ破損が発生する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Snapdragon の以下のプラットフォームはすべて影響を受けます: Snapdragon Auto, Snapdragon CCW, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WBC, Snapdragon Wearables, 5G Fixed Wireless Access Platform, APQ8098, AR8031, AR8035, C‑V2X 9150, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, Flight RB5 5G Platform, FSM100 Platform, G1 Gen 1, G2 Gen 1, IQ6 Series Platform, IQ8 Series Platform, IQ9 Series Platform, …（以下同様に多数のバージョンが列挙されています）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "公式の対象表：Qualcomm, Inc. / Snapdragon。影響ありとして記載：APQ8098。影響ありとして記載：AR8031。影響ありとして記載：AR8035。影響ありとして記載：C-V2X 9150。影響ありとして記載：CSRA6620。影響ありとして記載：CSRA6640。影響ありとして記載：FastConnect 6200。影響ありとして記載：FastConnect 6700。影響ありとして記載：FastConnect 6800。影響ありとして記載：FastConnect 6900。影響ありとして記載：FastConnect 7800。影響ありとして記載：FSM100 Platform。影響ありとして記載：G1 Gen 1。影響ありとして記載：G2 Gen 1。影響ありとして記載：IQ6 Series Platform。影響ありとして記載：IQ8 Series Platform。影響ありとして記載：IQ9 Series Platform。影響ありとして記載：LeMans_AU_LGIT。影響ありとして記載：LeMansAU。影響ありとして記載：MDM9250。影響ありとして記載：MDM9628。影響ありとして記載：Milos。影響ありとして記載：Monaco_IOT。影響ありとして記載：Netrani。影響ありとして記載：Orne。影響ありとして記載：Palawan25。影響ありとして記載：Pandeiro。影響ありとして記載：QAM8255P。影響ありとして記載：QAM8295P。影響ありとして記載：QAMSRV1H。影響ありとして記載：QAMSRV1M。影響ありとして記載：QCA2066。影響ありとして記載：QCA6174A。影響ありとして記載：QCA6391。影響ありとして記載：QCA6564A。影響ありとして記載：QCA6564AU。影響ありとして記載：QCA6574。影響ありとして記載：QCA6574A。影響ありとして記載：QCA6574AU。影響ありとして記載：QCA6584AU。影響ありとして記載：QCA6595。影響ありとして記載：QCA6595AU。影響ありとして記載：QCA6678AQ。影響ありとして記載：QCA6688AQ。影響ありとして記載：QCA6696。影響ありとして記載：QCA6698AQ。影響ありとして記載：QCA6698AU。影響ありとして記載：QCA6797AQ。影響ありとして記載：QCA8081。影響ありとして記載：QCA8337。影響ありとして記載：QCA8695AU。影響ありとして記載：QCA9367。影響ありとして記載：QCA9377。影響ありとして記載：QCM2290。影響ありとして記載：QCM4325。影響ありとして記載：QCM4490。影響ありとして記載：QCM5430。影響ありとして記載：QCM6125。影響ありとして記載：QCM6490。影響ありとして記載：QCN6024。影響ありとして記載：QCN9011。影響ありとして記載：QCN9012。影響ありとして記載：QCN9024。影響ありとして記載：QCS2290。影響ありとして記載：QCS4290。影響ありとして記載：QCS4490。影響ありとして記載：QCS8550。影響ありとして記載：QLN1083BD。影響ありとして記載：QLN1086BD。影響ありとして記載：QMP1000。影響ありとして記載：QPA1083BD。影響ありとして記載：QPA1086BD。影響ありとして記載：QRB5165M。影響ありとして記載：QRB5165N。影響ありとして記載：QXM1083。影響ありとして記載：QXM1086。影響ありとして記載：QXM1093。影響ありとして記載：QXM1094。影響ありとして記載：QXM1095。影響ありとして記載：QXM1096。影響ありとして記載：Robotics RB2 Platform。影響ありとして記載：Robotics RB5 Platform。影響ありとして記載：SA4150P。影響ありとして記載：SA4155P。影響ありとして記載：SA6145P。影響ありとして記載：SA6150P。影響ありとして記載：SA6155。影響ありとして記載：SA6155P。影響ありとして記載：SA7255P。影響ありとして記載：SA7775P。影響ありとして記載：SA8145P。影響ありとして記載：SA8150P。影響ありとして記載：SA8155。影響ありとして記載：SA8155P。影響ありとして記載：SA8195P。影響ありとして記載：SA8255P。影響ありとして記載：SA8295P。影響ありとして記載：SA8620P。影響ありとして記載：SA8770P。影響ありとして記載：SA9000P。影響ありとして記載：SAR1165P。影響ありとして記載：SAR1250P。影響ありとして記載：SAR2130P。影響ありとして記載：SAR2230P。影響ありとして記載：SC8380XP。影響ありとして記載：SD626。影響ありとして記載：SD662。影響ありとして記載：SD865 5G。影響ありとして記載：SDA660。影響ありとして記載：SDM429W。影響ありとして記載：SDX61。影響ありとして記載：SM6225P。影響ありとして記載：SM6650P。影響ありとして記載：SM7325P。影響ありとして記載：SM7435。影響ありとして記載：SM7550。影響ありとして記載：SM7550P。影響ありとして記載：SM7635P。影響ありとして記載：SM7675。影響ありとして記載：SM7675P。影響ありとして記載：SM8475P。影響ありとして記載：SM8550P。影響ありとして記載：SM8635。影響ありとして記載：SM8635P。影響ありとして記載：SM8650Q。影響ありとして記載：SM8750P。影響ありとして記載：Snapdragon 480+ 5G Mobile Platform。影響ありとして記載：Snapdragon 778G+ 5G Mobile Platform。影響ありとして記載：Snapdragon 7c+ Gen 3 Compute。影響ありとして記載：Snapdragon 8 Elite。影響ありとして記載：Snapdragon 820Am。影響ありとして記載：Snapdragon 865+ 5G Mobile Platform。影響ありとして記載：Snapdragon 888+ 5G Mobile Platform。影響ありとして記載：Snapdragon AR1+ Gen 1 Platform。影響ありとして記載：Snapdragon XR2+ Gen 1 Platform。影響ありとして記載：SRV1H。影響ありとして記載：SRV1M。影響ありとして記載：SW5100。影響ありとして記載：SW5100P。影響ありとして記載：SW6100。影響ありとして記載：SW6100P。影響ありとして記載：SXR2230P。影響ありとして記載：SXR2250P。影響ありとして記載：SXR2330P。影響ありとして記載：SXR2350P。影響ありとして記載：Themisto。影響ありとして記載：WCD9326。影響ありとして記載：WCD9330。影響ありとして記載：WCD9335。影響ありとして記載：WCD9341。影響ありとして記載：WCD9360。影響ありとして記載：WCD9370。影響ありとして記載：WCD9371。影響ありとして記載：WCD9375。影響ありとして記載：WCD9378。影響ありとして記載：WCD9380。影響ありとして記載：WCD9385。影響ありとして記載：WCD9390。影響ありとして記載：WCD9395。影響ありとして記載：WCN3615。影響ありとして記載：WCN3620。影響ありとして記載：WCN3660B。影響ありとして記載：WCN3680B。影響ありとして記載：WCN3910。影響ありとして記載：WCN3950。影響ありとして記載：WCN3980。影響ありとして記載：WCN3988。影響ありとして記載：WCN3990。影響ありとして記載：WCN6450。影響ありとして記載：WCN6650。影響ありとして記載：WCN6755。影響ありとして記載：WCN7860。影響ありとして記載：WCN7861。影響ありとして記載：WCN7880。影響ありとして記載：WCN7881。影響ありとして記載：WSA8810。影響ありとして記載：WSA8815。影響ありとして記載：WSA8830。影響ありとして記載：WSA8832。影響ありとして記載：WSA8835。影響ありとして記載：WSA8840。影響ありとして記載：WSA8845。影響ありとして記載：WSA8845H。対象の環境：Snapdragon Auto、Snapdragon CCW、Snapdragon Compute、Snapdragon Connectivity、Snapdragon Consumer IOT、Snapdragon Industrial IOT、Snapdragon Mobile、Snapdragon Voice & Music、Snapdragon WBC、Snapdragon Wearables", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Snapdragon」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21385", "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "https://nvd.nist.gov/vuln/detail/CVE-2026-21385" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-21385", "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "https://nvd.nist.gov/vuln/detail/CVE-2026-21385" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21385", "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "https://nvd.nist.gov/vuln/detail/CVE-2026-21385" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "label": "CVE：qualcomm" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21385", "label": "CVE公式レコード" }, { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html", "label": "CVE掲載の参考情報" }, { "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21385", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourceField": "/containers/cna/title", "excerpt": "Integer Overflow or Wraparound in Graphics", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Memory corruption while using alignments for memory allocation.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21385.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"Snapdragon Auto\",\"Snapdragon CCW\",\"Snapdragon Compute\",\"Snapdragon Connectivity\",\"Snapdragon Consumer IOT\",\"Snapdragon Industrial IOT\",\"Snapdragon Mobile\",\"Snapdragon Voice & Music\",\"Snapdragon WBC\",\"Snapdragon Wearables\"],\"product\":\"Snapdragon\",\"vendor\":\"Qualcomm, Inc.\",\"versions\":[{\"status\":\"affected\",\"version\":\"5G Fixed Wireless Access Platform\"},{\"status\":\"affected\",\"version\":\"APQ8098\"},{\"status\":\"affected\",\"version\":\"AR8031\"},{\"status\":\"affected\",\"version\":\"AR8035\"},{\"status\":\"affected\",\"version\":\"C-V2X 9150\"},{\"status\":\"affected\",\"version\":\"CSRA6620\"},{\"status\":\"affected\",\"version\":\"CSRA6640\"},{\"status\":\"affected\",\"version\":\"FastConnect 6200\"},{\"status\":\"affected\",\"version\":\"FastConnect 6700\"},{\"status\":\"affected\",\"version\":\"FastConnect 6800\"},{\"status\":\"affected\",\"version\":\"FastConnect 6900\"},{\"status\":\"affected\",\"version\":\"FastConnect 7800\"},{\"status\":\"affected\",\"version\":\"Flight RB5 5G Platform\"},{\"status\":\"affected\",\"version\":\"FSM100 Platform\"},{\"status\":\"affected\",\"version\":\"G1 Gen 1\"},{\"status\":\"affected\",\"version\":\"G2 Gen 1\"},{\"status\":\"affected\",\"version\":\"IQ6 Series Platform\"},{\"status\":\"affected\",\"version\":\"IQ8 Series Platform\"},{\"status\":\"affected\",\"version\":\"IQ9 Series Platform\"},{\"status\":\"affected\",\"version\":\"LeMans_AU_LGIT\"},{\"status\":\"affected\",\"version\":\"LeMansAU\"},{\"status\":\"affected\",\"version\":\"MDM9250\"},{\"status\":\"affected\",\"version\":\"MDM9628\"},{\"status\":\"affected\",\"version\":\"Milos\"},{\"status\":\"affected\",\"version\":\"Monaco_IOT\"},{\"status\":\"affected\",\"version\":\"Netrani\"},{\"status\":\"affected\",\"version\":\"Orne\"},{\"status\":\"affected\",\"version\":\"Palawan25\"},{\"status\":\"affected\",\"version\":\"Pandeiro\"},{\"status\":\"affected\",\"version\":\"QAM8255P\"},{\"status\":\"affected\",\"version\":\"QAM8295P\"},{\"status\":\"affected\",\"version\":\"QAMSRV1H\"},{\"status\":\"affected\",\"version\":\"QAMSRV1M\"},{\"status\":\"affected\",\"version\":\"QCA2066\"},{\"status\":\"affected\",\"version\":\"QCA6174A\"},{\"status\":\"affected\",\"version\":\"QCA6391\"},{\"status\":\"affected\",\"version\":\"QCA6564A\"},{\"status\":\"affected\",\"version\":\"QCA6564AU\"},{\"status\":\"affected\",\"version\":\"QCA6574\"},{\"status\":\"affected\",\"version\":\"QCA6574A\"},{\"status\":\"affected\",\"version\":\"QCA6574AU\"},{\"status\":\"affected\",\"version\":\"QCA6584AU\"},{\"status\":\"affected\",\"version\":\"QCA6595\"},{\"status\":\"affected\",\"version\":\"QCA6595AU\"},{\"status\":\"affected\",\"version\":\"QCA6678AQ\"},{\"status\":\"affected\",\"version\":\"QCA6688AQ\"},{\"status\":\"affected\",\"version\":\"QCA6696\"},{\"status\":\"affected\",\"version\":\"QCA6698AQ\"},{\"status\":\"affected\",\"version\":\"QCA6698AU\"},{\"status\":\"affected\",\"version\":\"QCA6797AQ\"},{\"status\":\"affected\",\"version\":\"QCA8081\"},{\"status\":\"affected\",\"version\":\"QCA8337\"},{\"status\":\"affected\",\"version\":\"QCA8695AU\"},{\"status\":\"affected\",\"version\":\"QCA9367\"},{\"status\":\"affected\",\"version\":\"QCA9377\"},{\"status\":\"affected\",\"version\":\"QCM2290\"},{\"status\":\"affected\",\"version\":\"QCM4325\"},{\"status\":\"affected\",\"version\":\"QCM4490\"},{\"status\":\"affected\",\"version\":\"QCM5430\"},{\"status\":\"affected\",\"version\":\"QCM6125\"},{\"status\":\"affected\",\"version\":\"QCM6490\"},{\"status\":\"affected\",\"version\":\"QCN6024\"},{\"status\":\"affected\",\"version\":\"QCN9011\"},{\"status\":\"affected\",\"version\":\"QCN9012\"},{\"status\":\"affected\",\"version\":\"QCN9024\"},{\"status\":\"affected\",\"version\":\"QCS2290\"},{\"status\":\"affected\",\"version\":\"QCS4290\"},{\"status\":\"affected\",\"version\":\"QCS4490\"},{\"status\":\"affected\",\"version\":\"QCS8550\"},{\"status\":\"affected\",\"version\":\"QLN1083BD\"},{\"status\":\"affected\",\"version\":\"QLN1086BD\"},{\"status\":\"affected\",\"version\":\"QMP1000\"},{\"status\":\"affected\",\"version\":\"QPA1083BD\"},{\"status\":\"affected\",\"version\":\"QPA1086BD\"},{\"status\":\"affected\",\"version\":\"QRB5165M\"},{\"status\":\"affected\",\"version\":\"QRB5165N\"},{\"status\":\"affected\",\"version\":\"Qualcomm 215 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC1 Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC3 Platform\"},{\"status\":\"affected\",\"version\":\"Qualcomm Video Collaboration VC5 Platform\"},{\"status\":\"affected\",\"version\":\"QXM1083\"},{\"status\":\"affected\",\"version\":\"QXM1086\"},{\"status\":\"affected\",\"version\":\"QXM1093\"},{\"status\":\"affected\",\"version\":\"QXM1094\"},{\"status\":\"affected\",\"version\":\"QXM1095\"},{\"status\":\"affected\",\"version\":\"QXM1096\"},{\"status\":\"affected\",\"version\":\"Robotics RB2 Platform\"},{\"status\":\"affected\",\"version\":\"Robotics RB5 Platform\"},{\"status\":\"affected\",\"version\":\"SA4150P\"},{\"status\":\"affected\",\"version\":\"SA4155P\"},{\"status\":\"affected\",\"version\":\"SA6145P\"},{\"status\":\"affected\",\"version\":\"SA6150P\"},{\"status\":\"affected\",\"version\":\"SA6155\"},{\"status\":\"affected\",\"version\":\"SA6155P\"},{\"status\":\"affected\",\"version\":\"SA7255P\"},{\"status\":\"affected\",\"version\":\"SA7775P\"},{\"status\":\"affected\",\"version\":\"SA8145P\"},{\"status\":\"affected\",\"version\":\"SA8150P\"},{\"status\":\"affected\",\"version\":\"SA8155\"},{\"status\":\"affected\",\"version\":\"SA8155P\"},{\"status\":\"affected\",\"version\":\"SA8195P\"},{\"status\":\"affected\",\"version\":\"SA8255P\"},{\"status\":\"affected\",\"version\":\"SA8295P\"},{\"status\":\"affected\",\"version\":\"SA8620P\"},{\"status\":\"affected\",\"version\":\"SA8770P\"},{\"status\":\"affected\",\"version\":\"SA9000P\"},{\"status\":\"affected\",\"version\":\"SAR1165P\"},{\"status\":\"affected\",\"version\":\"SAR1250P\"},{\"status\":\"affected\",\"version\":\"SAR2130P\"},{\"status\":\"affected\",\"version\":\"SAR2230P\"},{\"status\":\"affected\",\"version\":\"SC8380XP\"},{\"status\":\"affected\",\"version\":\"SD 8 Gen1 5G\"},{\"status\":\"affected\",\"version\":\"SD626\"},{\"status\":\"affected\",\"version\":\"SD662\"},{\"status\":\"affected\",\"version\":\"SD865 5G\"},{\"status\":\"affected\",\"version\":\"SDA660\"},{\"status\":\"affected\",\"version\":\"SDM429W\"},{\"status\":\"affected\",\"version\":\"SDX61\"},{\"status\":\"affected\",\"version\":\"SM6225P\"},{\"status\":\"affected\",\"version\":\"SM6650P\"},{\"status\":\"affected\",\"version\":\"SM7325P\"},{\"status\":\"affected\",\"version\":\"SM7435\"},{\"status\":\"affected\",\"version\":\"SM7550\"},{\"status\":\"affected\",\"version\":\"SM7550P\"},{\"status\":\"affected\",\"version\":\"SM7635P\"},{\"status\":\"affected\",\"version\":\"SM7675\"},{\"status\":\"affected\",\"version\":\"SM7675P\"},{\"status\":\"affected\",\"version\":\"SM8475P\"},{\"status\":\"affected\",\"version\":\"SM8550P\"},{\"status\":\"affected\",\"version\":\"SM8635\"},{\"status\":\"affected\",\"version\":\"SM8635P\"},{\"status\":\"affected\",\"version\":\"SM8650Q\"},{\"status\":\"affected\",\"version\":\"SM8750P\"},{\"status\":\"affected\",\"version\":\"Smart Audio 400 Platform\"},{\"status\":\"affected\",\"version\":\"Smart Display 200 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 4 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 4 Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 429 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 460 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 480 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 480+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 6 Gen 4 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 625 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 626 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 660 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 662 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 680 4G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 685 4G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 690 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 695 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7+ Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 778G 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 778G+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 782G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7c+ Gen 3 Compute\"},{\"status\":\"affected\",\"version\":\"Snapdragon 7s Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Elite\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Elite Gen 5\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8 Gen 3 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8+ Gen 1 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 8+ Gen 2 Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 820 Automotive Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 820Am\"},{\"status\":\"affected\",\"version\":\"Snapdragon 865 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 865+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 870 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 888 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon 888+ 5G Mobile Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon AR1 Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon AR1+ Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon Auto 5G Modem-RF\"},{\"status\":\"affected\",\"version\":\"Snapdragon W5+ Gen 1 Wearable Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon X12 LTE Modem\"},{\"status\":\"affected\",\"version\":\"Snapdragon X5 LTE Modem\"},{\"status\":\"affected\",\"version\":\"Snapdragon X53 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon X55 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon X65 5G Modem-RF System\"},{\"status\":\"affected\",\"version\":\"Snapdragon XR2 5G Platform\"},{\"status\":\"affected\",\"version\":\"Snapdragon XR2+ Gen 1 Platform\"},{\"status\":\"affected\",\"version\":\"SRV1H\"},{\"status\":\"affected\",\"version\":\"SRV1M\"},{\"status\":\"affected\",\"version\":\"SW5100\"},{\"status\":\"affected\",\"version\":\"SW5100P\"},{\"status\":\"affected\",\"version\":\"SW6100\"},{\"status\":\"affected\",\"version\":\"SW6100P\"},{\"status\":\"affected\",\"version\":\"SXR2230P\"},{\"status\":\"affected\",\"version\":\"SXR2250P\"},{\"status\":\"affected\",\"version\":\"SXR2330P\"},{\"status\":\"affected\",\"version\":\"SXR2350P\"},{\"status\":\"affected\",\"version\":\"Themisto\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 100 Platform\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 200 Platform\"},{\"status\":\"affected\",\"version\":\"Vision Intelligence 400 Platform\"},{\"status\":\"affected\",\"version\":\"WCD9326\"},{\"status\":\"affected\",\"version\":\"WCD9330\"},{\"status\":\"affected\",\"version\":\"WCD9335\"},{\"status\":\"affected\",\"version\":\"WCD9341\"},{\"status\":\"affected\",\"version\":\"WCD9360\"},{\"status\":\"affected\",\"version\":\"WCD9370\"},{\"status\":\"affected\",\"version\":\"WCD9371\"},{\"status\":\"affected\",\"version\":\"WCD9375\"},{\"status\":\"affected\",\"version\":\"WCD9378\"},{\"status\":\"affected\",\"version\":\"WCD9380\"},{\"status\":\"affected\",\"version\":\"WCD9385\"},{\"status\":\"affected\",\"version\":\"WCD9390\"},{\"status\":\"affected\",\"version\":\"WCD9395\"},{\"status\":\"affected\",\"version\":\"WCN3615\"},{\"status\":\"affected\",\"version\":\"WCN3620\"},{\"status\":\"affected\",\"version\":\"WCN3660B\"},{\"status\":\"affected\",\"version\":\"WCN3680B\"},{\"status\":\"affected\",\"version\":\"WCN3910\"},{\"status\":\"affected\",\"version\":\"WCN3950\"},{\"status\":\"affected\",\"version\":\"WCN3980\"},{\"status\":\"affected\",\"version\":\"WCN3988\"},{\"status\":\"affected\",\"version\":\"WCN3990\"},{\"status\":\"affected\",\"version\":\"WCN6450\"},{\"status\":\"affected\",\"version\":\"WCN6650\"},{\"status\":\"affected\",\"version\":\"WCN6755\"},{\"status\":\"affected\",\"version\":\"WCN7860\"},{\"status\":\"affected\",\"version\":\"WCN7861\"},{\"status\":\"affected\",\"version\":\"WCN7880\"},{\"status\":\"affected\",\"version\":\"WCN7881\"},{\"status\":\"affected\",\"version\":\"WSA8810\"},{\"status\":\"affected\",\"version\":\"WSA8815\"},{\"status\":\"affected\",\"version\":\"WSA8830\"},{\"status\":\"affected\",\"version\":\"WSA8832\"},{\"status\":\"affected\",\"version\":\"WSA8835\"},{\"status\":\"affected\",\"version\":\"WSA8840\"},{\"status\":\"affected\",\"version\":\"WSA8845\"},{\"status\":\"affected\",\"version\":\"WSA8845H\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21385", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-21385\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-21385（Snapdragon）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Snapdragon の以下のプラットフォームはすべて影響を受けます: Snapdragon Auto, Snapdragon CCW, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WBC, Snapdragon Wearables, 5G Fixed Wireless Access Platform, APQ8098, AR8031, AR8035, C‑V2X 9150, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, Flight RB5 5G Platform, FSM100 Platform, G1 Gen 1, G2 Gen 1, IQ6 Series Platform, IQ8 Series Platform, IQ9 Series Platform, …（以下同様に多数のバージョンが列挙されています）\n・公式の対象表：Qualcomm, Inc. / Snapdragon。影響ありとして記載：APQ8098。影響ありとして記載：AR8031。影響ありとして記載：AR8035。影響ありとして記載：C-V2X 9150。影響ありとして記載：CSRA6620。影響ありとして記載：CSRA6640。影響ありとして記載：FastConnect 6200。影響ありとして記載：FastConnect 6700。影響ありとして記載：FastConnect 6800。影響ありとして記載：FastConnect 6900。影響ありとして記載：FastConnect 7800。影響ありとして記載：FSM100 Platform。影響ありとして記載：G1 Gen 1。影響ありとして記載：G2 Gen 1。影響ありとして記載：IQ6 Series Platform。影響ありとして記載：IQ8 Series Platform。影響ありとして記載：IQ9 Series Platform。影響ありとして記載：LeMans_AU_LGIT。影響ありとして記載：LeMansAU。影響ありとして記載：MDM9250。影響ありとして記載：MDM9628。影響ありとして記載：Milos。影響ありとして記載：Monaco_IOT。影響ありとして記載：Netrani。影響ありとして記載：Orne。影響ありとして記載：Palawan25。影響ありとして記載：Pandeiro。影響ありとして記載：QAM8255P。影響ありとして記載：QAM8295P。影響ありとして記載：QAMSRV1H。影響ありとして記載：QAMSRV1M。影響ありとして記載：QCA2066。影響ありとして記載：QCA6174A。影響ありとして記載：QCA6391。影響ありとして記載：QCA6564A。影響ありとして記載：QCA6564AU。影響ありとして記載：QCA6574。影響ありとして記載：QCA6574A。影響ありとして記載：QCA6574AU。影響ありとして記載：QCA6584AU。影響ありとして記載：QCA6595。影響ありとして記載：QCA6595AU。影響ありとして記載：QCA6678AQ。影響ありとして記載：QCA6688AQ。影響ありとして記載：QCA6696。影響ありとして記載：QCA6698AQ。影響ありとして記載：QCA6698AU。影響ありとして記載：QCA6797AQ。影響ありとして記載：QCA8081。影響ありとして記載：QCA8337。影響ありとして記載：QCA8695AU。影響ありとして記載：QCA9367。影響ありとして記載：QCA9377。影響ありとして記載：QCM2290。影響ありとして記載：QCM4325。影響ありとして記載：QCM4490。影響ありとして記載：QCM5430。影響ありとして記載：QCM6125。影響ありとして記載：QCM6490。影響ありとして記載：QCN6024。影響ありとして記載：QCN9011。影響ありとして記載：QCN9012。影響ありとして記載：QCN9024。影響ありとして記載：QCS2290。影響ありとして記載：QCS4290。影響ありとして記載：QCS4490。影響ありとして記載：QCS8550。影響ありとして記載：QLN1083BD。影響ありとして記載：QLN1086BD。影響ありとして記載：QMP1000。影響ありとして記載：QPA1083BD。影響ありとして記載：QPA1086BD。影響ありとして記載：QRB5165M。影響ありとして記載：QRB5165N。影響ありとして記載：QXM1083。影響ありとして記載：QXM1086。影響ありとして記載：QXM1093。影響ありとして記載：QXM1094。影響ありとして記載：QXM1095。影響ありとして記載：QXM1096。影響ありとして記載：Robotics RB2 Platform。影響ありとして記載：Robotics RB5 Platform。影響ありとして記載：SA4150P。影響ありとして記載：SA4155P。影響ありとして記載：SA6145P。影響ありとして記載：SA6150P。影響ありとして記載：SA6155。影響ありとして記載：SA6155P。影響ありとして記載：SA7255P。影響ありとして記載：SA7775P。影響ありとして記載：SA8145P。影響ありとして記載：SA8150P。影響ありとして記載：SA8155。影響ありとして記載：SA8155P。影響ありとして記載：SA8195P。影響ありとして記載：SA8255P。影響ありとして記載：SA8295P。影響ありとして記載：SA8620P。影響ありとして記載：SA8770P。影響ありとして記載：SA9000P。影響ありとして記載：SAR1165P。影響ありとして記載：SAR1250P。影響ありとして記載：SAR2130P。影響ありとして記載：SAR2230P。影響ありとして記載：SC8380XP。影響ありとして記載：SD626。影響ありとして記載：SD662。影響ありとして記載：SD865 5G。影響ありとして記載：SDA660。影響ありとして記載：SDM429W。影響ありとして記載：SDX61。影響ありとして記載：SM6225P。影響ありとして記載：SM6650P。影響ありとして記載：SM7325P。影響ありとして記載：SM7435。影響ありとして記載：SM7550。影響ありとして記載：SM7550P。影響ありとして記載：SM7635P。影響ありとして記載：SM7675。影響ありとして記載：SM7675P。影響ありとして記載：SM8475P。影響ありとして記載：SM8550P。影響ありとして記載：SM8635。影響ありとして記載：SM8635P。影響ありとして記載：SM8650Q。影響ありとして記載：SM8750P。影響ありとして記載：Snapdragon 480+ 5G Mobile Platform。影響ありとして記載：Snapdragon 778G+ 5G Mobile Platform。影響ありとして記載：Snapdragon 7c+ Gen 3 Compute。影響ありとして記載：Snapdragon 8 Elite。影響ありとして記載：Snapdragon 820Am。影響ありとして記載：Snapdragon 865+ 5G Mobile Platform。影響ありとして記載：Snapdragon 888+ 5G Mobile Platform。影響ありとして記載：Snapdragon AR1+ Gen 1 Platform。影響ありとして記載：Snapdragon XR2+ Gen 1 Platform。影響ありとして記載：SRV1H。影響ありとして記載：SRV1M。影響ありとして記載：SW5100。影響ありとして記載：SW5100P。影響ありとして記載：SW6100。影響ありとして記載：SW6100P。影響ありとして記載：SXR2230P。影響ありとして記載：SXR2250P。影響ありとして記載：SXR2330P。影響ありとして記載：SXR2350P。影響ありとして記載：Themisto。影響ありとして記載：WCD9326。影響ありとして記載：WCD9330。影響ありとして記載：WCD9335。影響ありとして記載：WCD9341。影響ありとして記載：WCD9360。影響ありとして記載：WCD9370。影響ありとして記載：WCD9371。影響ありとして記載：WCD9375。影響ありとして記載：WCD9378。影響ありとして記載：WCD9380。影響ありとして記載：WCD9385。影響ありとして記載：WCD9390。影響ありとして記載：WCD9395。影響ありとして記載：WCN3615。影響ありとして記載：WCN3620。影響ありとして記載：WCN3660B。影響ありとして記載：WCN3680B。影響ありとして記載：WCN3910。影響ありとして記載：WCN3950。影響ありとして記載：WCN3980。影響ありとして記載：WCN3988。影響ありとして記載：WCN3990。影響ありとして記載：WCN6450。影響ありとして記載：WCN6650。影響ありとして記載：WCN6755。影響ありとして記載：WCN7860。影響ありとして記載：WCN7861。影響ありとして記載：WCN7880。影響ありとして記載：WCN7881。影響ありとして記載：WSA8810。影響ありとして記載：WSA8815。影響ありとして記載：WSA8830。影響ありとして記載：WSA8832。影響ありとして記載：WSA8835。影響ありとして記載：WSA8840。影響ありとして記載：WSA8845。影響ありとして記載：WSA8845H。対象の環境：Snapdragon Auto、Snapdragon CCW、Snapdragon Compute、Snapdragon Connectivity、Snapdragon Consumer IOT、Snapdragon Industrial IOT、Snapdragon Mobile、Snapdragon Voice & Music、Snapdragon WBC、Snapdragon Wearables\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-21385", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:42.210Z", "lastSuccess": "2026-10-23T03:24:42.210Z", "sourceCheckedAt": "2026-10-23T02:43:47.622Z", "errorCode": null }, "glossary": [] } } ], "total": 2206, "limit": 20, "offset": 620, "filters": { "product": "all", "type": "all", "q": "", "page": 32 }, "pagination": { "page": 32, "pageSize": 20, "totalPages": 111 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T00:17:49.426Z", "lastAttempt": "2026-10-24T00:17:49.426Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-24T00:17:49.426Z", "lastAttempt": "2026-10-24T00:17:49.426Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T00:17:49.426Z", "lastAttempt": "2026-10-24T00:17:49.426Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-23T19:17:50.573Z", "lastAttempt": "2026-10-24T00:17:49.426Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 1, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T19:02:50.573Z 〜 2026-10-23T21:17:50.096Z、全製品の変更 2000/2161件まで確認、対象1件反映。", "cursor": { "start": "2026-10-23T19:02:50.573Z", "end": "2026-10-23T21:17:50.096Z", "kind": "modified", "index": 2000 }, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T00:17:49.426Z", "lastAttempt": "2026-10-24T00:17:49.426Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }