Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "TranZman Migration",
"vendor": "Cohesity",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "GregD via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hi,\n\nI'm disclosing five vulnerabilities discovered during an authorised \nsecurity assessment of the Cohesity TranZman Migration Appliance \n(formerly Stone Ram TranZman), Release 4.0 Build 14614.\n\nCVE-2025-67840 - Web API Command Injection (CVSS 7.2 High)\nThe /api/v1/scheduler/run and /api/v1/actions/run endpoints allow \nauthenticated administrators to execute arbitrary commands as root by \ninjecting into POST request parameters. Input is not properly sanitised \nbefore being passed to system commands.\n\nCVE-2025-63911 - CLISH Command Injection (CVSS 7.2 High)\nMultiple command injection vectors exist in the CLISH restricted shell, \nallowing authenticated users to escape the restricted environment and \ngain elevated command execution via local privilege escalation.\n\nCVE-2025-63909 - Local Privilege Escalation (CVSS 7.2 High)\nIncorrect access control in /opt/SRLtzm/bin/TapeDumper allows \nauthenticated users to escalate privileges to root.\n\nCVE-2025-63910 - Unsigned Patch Upload (CVSS 7.2 High)\nThe patch upload mechanism does not verify signatures, allowing remote \ncode execution via crafted patch files.\n\nCVE-2025-63912 - Weak Cryptography / Static XOR (CVSS 5.5 Medium)\nThe TranZman FTP service (port 55555/TCP) uses XOR with a static, \nhardcoded key instead of proper encryption. An attacker who can\nobserve network traffic can decrypt the entire control channel - \nexposing credentials, commands, and backup filenames - and forge or \nreplay commands to retrieve or tamper with files in transit.\n\nAffected versions: Release 4.0 Build 14614 including patch\nTZM_1757588060_SEP2025_FULL.depot\n\nVendor timeline:\n- 26 September 2025: Reported to Cohesity\n- 20 October 2025: Cohesity confirmed patches available\n- 25 December 2025: 90-day embargo ended\n- 27 December 2025: Public disclosure\n\nPatches: Apply TZM_patch_1.patch followed by\nTZM_1760106063_OCT2025R2_FULL.depot. Contact Cohesity support\nfor the latest OVA with integrated fixes.\n\nFull advisories with techincal details:\nhttps://github.com/GregDurys/Cohesity-TranZman-CVEs\n\nIndividual advisories (Gists):\nhttps://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270\nhttps://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef\nhttps://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9\nhttps://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2\nhttps://gist.github.com/GregDurys/4c2765d76272cda64dfc78f7a75a9251\n\nRegards,\nGreg Durys\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:13:10Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/3"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/3"
},
{
"url": "https://gist.github.com/GregDurys/4c2765d76272cda64dfc78f7a75a9251"
},
{
"url": "https://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9"
},
{
"url": "https://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2"
},
{
"url": "https://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef"
},
{
"url": "https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270"
},
{
"url": "https://github.com/GregDurys/Cohesity-TranZman-CVEs"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/3"
],
"discovery": "EXTERNAL"
},
"title": "Cohesity TranZman Migration Appliance - 5 CVEs (command injection, LPE, unsigned patches, weak crypto)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-63909",
"type": "related"
},
{
"destId": "CVE-2025-63910",
"type": "related"
},
{
"destId": "CVE-2025-63911",
"type": "related"
},
{
"destId": "CVE-2025-63912",
"type": "related"
},
{
"destId": "CVE-2025-67840",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0241",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/3",
"automated": true,
"contentSha256": "f3ecf8ef46a60bc2937b15246c30792a22291599f58f024b95cfb0f1e2e5f1c4",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/3",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-08T11:18:05Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:41Z",
"dateUpdated": "2026-09-11T11:13:10Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0241"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}