SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying
David Brown via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Privilege escalation via request replaying in Lobster_pro ========================================================= version 4.12.12-LTS and potentially other versions prior to 25.1.3. Metadata ======== - - Affected product: Lobster_pro - - Vendor: Lobster DATA GmbH - - CVE ID: CVE-2026-3322 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-3322 - - CVSS 4.0 score: 5.6 - - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/ Details ======= Risk ==== information stored in Lobster_pro. Solution/Mitigation =================== Update Lobster_pro to version 25.1.3 or later. Timeline ======== - - 2025-06-26 Vulnerability reported to vendor - - 2025-10-09 Vendor releases version 25.0.1 to address the vulnerability - - 2025-11-19 Vendor releases version 25.1.3 with additional fixes undisclosed reasons. - - 2026-10-26 Advisory released Credits ======= The vulnerability was discovered by Daniel Marner of SCHUTZWERK GmbH. Footnotes ========= [0] https://en.wikipedia.org/wiki/Action_Message_Format -----BEGIN PGP SIGNATURE----- iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmrfZz0aHGFkdmlzb3Jp ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsQ9g/+MUYMsmoaxs5JxKD5Obas SIbfHKCwSutmpE1Q8j0Ao5oG3IR9Zo0SgFhFFPelH5E7Q6lf2C0YbretCMvxCFXx Ybg5VX9OFQFazRDP/9mx9LaT+ZSwBFLMnlPDM5Pwudn7xoNEoVmRbNIibwVhhzqB U2Hmd0gHfUZbhtA95lCm6ODKBFxqV1MP/LRYbVM8Qp6BBT0V357VsVfUwAcNyKdo ObmuXRA9p2iuElF67DwjAvLYNzU4C2/eUjLw9T9pJhKNs+hBh7hYFi6UefWOQ1MI bNTMA9Ngw42Jed/Be69un9Fw0D+09CWx/PmXbcVnvEhpLLA846bbJ27uWJvuFn4t waKpNx9uka2TRaFsF20VE3Wa+EaCT2OajFcZVXy+KOK4ZMNyeACStc0SI6kLOFIZ MgvFc+GWq48DIJvAugt0d16O5tQcD/+rSt0RP/jV++hTUAeIUKEPjarJi4j+wkpj QhDUBhl+R5cgmOr43bPhwYYUnd9uJMHa6p0X+54vnJPhv2zkDPRbJCMrNHkK4giK Vc8F+Kvl6B4r0gbVKY5jD48Ups8tOLaX1S2KkixlwZf7vKQw4gIlJPMEPZt9dEaS 8K59OYPiIIe7prOk2nbZQjGQ344lezd9rEdV3UZgucRSRnnJb7sCX6hVC7K4DSeS 5wvZd03jEsRq4o+PWaKo9wg= =vwsA -----END PGP SIGNATURE----- -- SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany Zertifiziert / Certified ISO 27001, 9001 and TISAX Phone +49 731 977 191 0 advisories () schutzwerk com / www.schutzwerk.com Geschäftsführer / Managing Directors: Jakob Pietzka, Michael Schäfer Amtsgericht Ulm / HRB 727391 Datenschutz / Data Protection www.schutzwerk.com/datenschutz _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/