🚨 Critical CVEs Today: IoT & Cloud Stack (CVSS 9.8-9.8) Affected: Milesight AIOT; NVIDIA NVFlare Dashboard; Totolink A8000RU CGI Handler Internet-facing risks dominate, led by IoT devices and cloud platforms; fixes and mitigations below. • CVE-2026-32644 (CVSS 9.8) Milesight AIOT cameras with affected firmware versions use SSL certificates with default private keys. • CVE-2026-24178 (CVSS 9.8) NVIDIA NVFlare Dashboard (unspecified versions) contains unauthenticated authorization bypass via a user-controlled key. • CVE-2026-7202 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setWiFiWpsStart allows remote OS command injection via wscDisabled. • CVE-2026-7203 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setUrlFilterRules allows remote OS command injection via enable parameter. • CVE-2026-7204 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setPptpServerCfg allows remote OS command injection via enable parameter. 🛠️ Action • Patch/upgrade to the fixed versions called out (or vendor advisory latest) • Prioritize internet-facing instances and edge appliances first • If "no fix yet", apply the stated mitigations and reduce exposure (disable feature/module, restrict access) • Add detections for the exploitation patterns implied by the CVEs (process spawning, webshell/file-write paths, auth anomalies) • Hunt for indicators around the affected services during the disclosure-to-now window (logs, EDR, WAF) • Validate remediation (version checks, config verification) and monitor for reversion
Post summary
The post summarizes critical IoT and cloud CVEs with technical details and stresses the importance of applying vendor patches and mitigations.
