GCVE-1988-2026-0241
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:13
VLAI
EPSS
VEX
Title
Cohesity TranZman Migration Appliance - 5 CVEs (command injection, LPE, unsigned patches, weak crypto)
Summary
Hi,
I'm disclosing five vulnerabilities discovered during an authorised
security assessment of the Cohesity TranZman Migration Appliance
(formerly Stone Ram TranZman), Release 4.0 Build 14614.
CVE-2025-67840 - Web API Command Injection (CVSS 7.2 High)
The /api/v1/scheduler/run and /api/v1/actions/run endpoints allow
authenticated administrators to execute arbitrary commands as root by
injecting into POST request parameters. Input is not properly sanitised
before being passed to system commands.
CVE-2025-63911 - CLISH Command Injection (CVSS 7.2 High)
Multiple command injection vectors exist in the CLISH restricted shell,
allowing authenticated users to escape the restricted environment and
gain elevated command execution via local privilege escalation.
CVE-2025-63909 - Local Privilege Escalation (CVSS 7.2 High)
Incorrect access control in /opt/SRLtzm/bin/TapeDumper allows
authenticated users to escalate privileges to root.
CVE-2025-63910 - Unsigned Patch Upload (CVSS 7.2 High)
The patch upload mechanism does not verify signatures, allowing remote
code execution via crafted patch files.
CVE-2025-63912 - Weak Cryptography / Static XOR (CVSS 5.5 Medium)
The TranZman FTP service (port 55555/TCP) uses XOR with a static,
hardcoded key instead of proper encryption. An attacker who can
observe network traffic can decrypt the entire control channel -
exposing credentials, commands, and backup filenames - and forge or
replay commands to retrieve or tamper with files in transit.
Affected versions: Release 4.0 Build 14614 including patch
TZM_1757588060_SEP2025_FULL.depot
Vendor timeline:
- 26 September 2025: Reported to Cohesity
- 20 October 2025: Cohesity confirmed patches available
- 25 December 2025: 90-day embargo ended
- 27 December 2025: Public disclosure
Patches: Apply TZM_patch_1.patch followed by
TZM_1760106063_OCT2025R2_FULL.depot. Contact Cohesity support
for the latest OVA with integrated fixes.
Full advisories with techincal details:
https://github.com/GregDurys/Cohesity-TranZman-CVEs
Individual advisories (Gists):
https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270
https://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef
https://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9
https://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2
https://gist.github.com/GregDurys/4c2765d76272cda64dfc78f7a75a9251
Regards,
Greg Durys
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Cohesity | TranZman Migration |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0241 (this record)
- related CVE-2025-63909
- related CVE-2025-63910
- related CVE-2025-63911
- related CVE-2025-63912
- related CVE-2025-67840
{
"containers": {
"cna": {
"affected": [
{
"product": "TranZman Migration",
"vendor": "Cohesity",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "GregD via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hi,\n\nI\u0027m disclosing five vulnerabilities discovered during an authorised \nsecurity assessment of the Cohesity TranZman Migration Appliance \n(formerly Stone Ram TranZman), Release 4.0 Build 14614.\n\nCVE-2025-67840 - Web API Command Injection (CVSS 7.2 High)\nThe /api/v1/scheduler/run and /api/v1/actions/run endpoints allow \nauthenticated administrators to execute arbitrary commands as root by \ninjecting into POST request parameters. Input is not properly sanitised \nbefore being passed to system commands.\n\nCVE-2025-63911 - CLISH Command Injection (CVSS 7.2 High)\nMultiple command injection vectors exist in the CLISH restricted shell, \nallowing authenticated users to escape the restricted environment and \ngain elevated command execution via local privilege escalation.\n\nCVE-2025-63909 - Local Privilege Escalation (CVSS 7.2 High)\nIncorrect access control in /opt/SRLtzm/bin/TapeDumper allows \nauthenticated users to escalate privileges to root.\n\nCVE-2025-63910 - Unsigned Patch Upload (CVSS 7.2 High)\nThe patch upload mechanism does not verify signatures, allowing remote \ncode execution via crafted patch files.\n\nCVE-2025-63912 - Weak Cryptography / Static XOR (CVSS 5.5 Medium)\nThe TranZman FTP service (port 55555/TCP) uses XOR with a static, \nhardcoded key instead of proper encryption. An attacker who can\nobserve network traffic can decrypt the entire control channel - \nexposing credentials, commands, and backup filenames - and forge or \nreplay commands to retrieve or tamper with files in transit.\n\nAffected versions: Release 4.0 Build 14614 including patch\nTZM_1757588060_SEP2025_FULL.depot\n\nVendor timeline:\n- 26 September 2025: Reported to Cohesity\n- 20 October 2025: Cohesity confirmed patches available\n- 25 December 2025: 90-day embargo ended\n- 27 December 2025: Public disclosure\n\nPatches: Apply TZM_patch_1.patch followed by\nTZM_1760106063_OCT2025R2_FULL.depot. Contact Cohesity support\nfor the latest OVA with integrated fixes.\n\nFull advisories with techincal details:\nhttps://github.com/GregDurys/Cohesity-TranZman-CVEs\n\nIndividual advisories (Gists):\nhttps://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270\nhttps://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef\nhttps://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9\nhttps://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2\nhttps://gist.github.com/GregDurys/4c2765d76272cda64dfc78f7a75a9251\n\nRegards,\nGreg Durys\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:13:10Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/3"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/3"
},
{
"url": "https://gist.github.com/GregDurys/4c2765d76272cda64dfc78f7a75a9251"
},
{
"url": "https://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9"
},
{
"url": "https://gist.github.com/GregDurys/8b7a3022c04b6cee8c1e1af04f5671b2"
},
{
"url": "https://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef"
},
{
"url": "https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270"
},
{
"url": "https://github.com/GregDurys/Cohesity-TranZman-CVEs"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/3"
],
"discovery": "EXTERNAL"
},
"title": "Cohesity TranZman Migration Appliance - 5 CVEs (command injection, LPE, unsigned patches, weak crypto)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-63909",
"type": "related"
},
{
"destId": "CVE-2025-63910",
"type": "related"
},
{
"destId": "CVE-2025-63911",
"type": "related"
},
{
"destId": "CVE-2025-63912",
"type": "related"
},
{
"destId": "CVE-2025-67840",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0241",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/3",
"automated": true,
"contentSha256": "f3ecf8ef46a60bc2937b15246c30792a22291599f58f024b95cfb0f1e2e5f1c4",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/3",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-08T11:18:05Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0241"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:41Z",
"dateUpdated": "2026-09-11T11:13:10Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0241"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…