{"id":"CVE-2026-0873","state":"PUBLISHED","title":"Privilege Elevation in Ercom Cryptobox administration console","description":"On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator.","publishedAt":"2026-02-04T10:42:14.626Z","updatedAt":"2026-02-04T14:56:23.511Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U","source":"THA-PSIRT"},"assigner":"THA-PSIRT","products":["Ercom Cryptobox"],"affected":[{"vendor":"Ercom","product":"Cryptobox","defaultStatus":"affected","versions":[{"version":"v4.40.x","status":"unaffected"}],"modules":["Administration console"]}],"references":["https://info.cryptobox.com/doc/v4.40/4.40.en/"],"weaknesses":["CWE-79","CWE-1220"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0873.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0873","state":"PUBLISHED","datePublished":"2026-02-04T10:42:14.626Z","dateUpdated":"2026-02-04T14:56:23.511Z","assignerShortName":"THA-PSIRT","assignerOrgId":"9d5917ae-205d-4ae5-8749-1f49479b1395","dateReserved":"2026-01-13T09:32:07.338Z"},"containers":{"cna":{"title":"Privilege Elevation in Ercom Cryptobox administration console","descriptions":[{"lang":"en","value":"On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator."}],"affected":[{"vendor":"Ercom","product":"Cryptobox","defaultStatus":"affected","versions":[{"version":"v4.40.x","status":"unaffected"}],"modules":["Administration console"]}],"references":[{"url":"https://info.cryptobox.com/doc/v4.40/4.40.en/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1220","description":"CWE-1220: Insufficient Granularity of Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"THA-PSIRT","orgId":"9d5917ae-205d-4ae5-8749-1f49479b1395","dateUpdated":"2026-02-04T10:42:14.626Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Multiple entities must be defined with dedicated administrators"}],"value":"Multiple entities must be defined with dedicated administrators"}],"datePublic":"2026-02-04T10:16:00.000Z","impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233: Privilege Escalation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to version 4.40.x."}],"value":"Upgrade to version 4.40.x."}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-04T14:56:16.541272Z","id":"CVE-2026-0873","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-04T14:56:23.511Z"}}]}}}