VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
2026-10-12T20:52:01Z•17998f78256dfbb7cfb909fe78a3111b2aea9f4193f68c24a72049f556d6caee
CVE-2026-103521CVE-2026-103522CVE-2026-103523CVE-2026-12855CVE-2026-18311CVE-2026-18312CVE-2026-75907CVE-2026-82356CVE-2026-82987CVE-2026-82988CVE-2026-82989CVE-2026-96760BIOSCERT/CCRFID-cloningSMMauthentication-bypasscross-site-scriptingcryptographic-key-managementdata-exfiltrationdevice-compromisefirmwaremultiple-vulnerabilitiesopen-redirectphysical-securityremote-code-executionserver-side-template-injectionsignature-verification-bypassunauthenticated-access
What happened
CERT/CC advisories describe multiple vulnerabilities across Thelia, InsydeH2O/HP BIOS, Authlib, Readwise Reader for Android, ViewSonic vCast, Norwegian Cruise Line door controllers, and Imprivata EAM. Impacts include remote code execution, SMM compromise, signature-verification bypass, XSS, unauthenticated screen exfiltration and device compromise, RFID credential cloning, and persistent appliance impersonation. Several issues are remotely exploitable or affect authentication and physical access controls.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 17998f78256dfbb7cfb909fe78a3111b2aea9f4193f68c24a72049f556d6caee
- Enrichment time
- 2026-10-12T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.