CVE Explorer

CVE-2026-12602

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:649f2ef5c5fc39fdf326d235ff275449a8655b9cfcf818c2ab0424c8b26f5e04

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"ArubaSign","vendor":"Aruba","versions":[{"lessThan":"4.6.6","status":"affected","version":"0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8de9cd307e8633d0113f1393e032594b2f90728cc5b54a053736162a00c63d54 · sha256:cba908548cdb1e3a… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":8.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpac…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8de9cd307e8633d0113f1393e032594b2f90728cc5b54a053736162a00c63d54 · sha256:cba908548cdb1e3a… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-276","description":"CWE-276 Incorrect default permissions","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8de9cd307e8633d0113f1393e032594b2f90728cc5b54a053736162a00c63d54 · sha256:cba908548cdb1e3a… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-permissions-arubasign-aruba"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8de9cd307e8633d0113f1393e032594b2f90728cc5b54a053736162a00c63d54 · sha256:cba908548cdb1e3a… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer