CVE-2026-0873

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0873", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-01-13T09:32:07.338Z", "datePublished": "2026-02-04T10:42:14.626Z", "dateUpdated": "2026-02-04T14:56:23.511Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Administration console"], "product": "Cryptobox", "vendor": "Ercom", "versions": [{"status": "unaffected", "version": "v4.40.x"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Multiple entities must be defined with dedicated administrators"}], "value": "Multiple entities must be defined with dedicated administrators"}], "datePublic": "2026-02-04T10:16:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator."}], "value": "On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233: Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.8, "baseSeverity": "MEDIUM", "exploitMaturity": "UNREPORTED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-02-04T10:42:14.626Z"}, "references": [{"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to version 4.40.x."}], "value": "Upgrade to version 4.40.x."}], "source": {"discovery": "INTERNAL"}, "title": "Privilege Elevation in Ercom Cryptobox administration console", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T14:56:16.541272Z", "id": "CVE-2026-0873", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T14:56:23.511Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0873", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T14:56:16.541272Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T14:56:20.349Z"}}], "cna": {"title": "Privilege Elevation in Ercom Cryptobox administration console", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233: Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ercom", "modules": ["Administration console"], "product": "Cryptobox", "versions": [{"status": "unaffected", "version": "v4.40.x"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.40.x.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to version 4.40.x.", "base64": false}]}], "datePublic": "2026-02-04T10:16:00.000Z", "references": [{"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator.", "supportingMedia": [{"type": "text/html", "value": "On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control"}]}], "configurations": [{"lang": "en", "value": "Multiple entities must be defined with dedicated administrators", "supportingMedia": [{"type": "text/html", "value": "Multiple entities must be defined with dedicated administrators", "base64": false}]}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-02-04T10:42:14.626Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0873", "state": "PUBLISHED", "dateUpdated": "2026-02-04T14:56:23.511Z", "dateReserved": "2026-01-13T09:32:07.338Z", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "datePublished": "2026-02-04T10:42:14.626Z", "assignerShortName": "THA-PSIRT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["Administration console"], "product": "Cryptobox", "vendor": "Ercom", "versions": [{"status": "unaffected", "version": "v4.40.x"}]}], "source": "psirt@thalesgroup.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator."}, {"lang": "es", "value": "En una plataforma Cryptobox donde se utiliza la segregaci\u00f3n de administradores basada en entidades, algunas vulnerabilidades en la consola de administraci\u00f3n Ercom Cryptobox permiten a un administrador de entidad autenticado con conocimiento elevar su cuenta a administrador global."}], "id": "CVE-2026-0873", "lastModified": "2026-06-17T10:11:32.370", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@thalesgroup.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0873", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T14:56:16.541272Z", "version": "2.0.3"}}]}, "published": "2026-02-04T11:16:02.797", "references": [{"source": "psirt@thalesgroup.com", "url": "https://info.cryptobox.com/doc/v4.40/4.40.en/"}], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1220"}], "source": "psirt@thalesgroup.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:50:49.616634+00:00", "value": {"mitigation_remediation": ["Upgrade the Ercom Cryptobox platform to version 4.40.x or later to receive the vendor-provided fixes.", "If immediate upgrade is infeasible, restrict entity administrator roles to the minimum necessary permissions and audit accounts that can perform privilege escalation.", "Monitor the administration console logs for unexpected changes in account privileges and establish alerts for privilege changes to detect potential abuse."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is the Ercom Cryptobox platform used in environments employing entity\u2011level administrator segregation. The exact version(s) impacted are not enumerated in the advisory, but the remedy specifies an upgrade to version 4.40.x, implying that prior releases are vulnerable.", "description_and_impact": "On Ercom Cryptobox platforms that enforce entity-based administrator segregation, a flaw in the administration console permits an authenticated entity administrator who has knowledge of a specific vulnerability to raise their own privileges to that of a global administrator. This allows the attacker to gain unrestricted access to all system resources, potentially leading to full control of the infrastructure. The weakness is associated with improper privilege and access controls (CWE\u20111220) and is also coupled with an input validation weakness that could enable cross\u2011site scripting (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog, indicating no publicly known exploits. The likely attack vector requires an authenticated entity administrator who has privileged knowledge of the console to abuse the flaw; no remote code execution or unauthenticated access is required. Overall, the risk to an organization with a permissive entity administrator role is significant because elevation removes controls and could compromise the entire system. However, the exploitability is constrained by the need for prior authentication and the specialized knowledge of the console."}}}}, "created": "2026-02-04T21:18:07.154264+00:00", "updated": "2026-04-18T00:00:09.474079+00:00", "vendors": ["ercom", "ercom$PRODUCT$cryptobox"]}