U.S. Election Assistance Commission Website Reported to Contain Critical Remote Code Execution Vulnerability

TechFlow reported on Oct. 29 that cybersecurity firm XBOW published a disclosure stating that it had discovered a critical remote code execution vulnerability exploitable without authentication in a public web application of the U.S. Election Assistance Commission (EAC). The application is used for resource and logistics calculations and is not a voting machine or voter registration system. The vulnerability could allow attackers to craft specific web requests to execute code in backend containers with root privileges and access locally protected resources and external networks. XBOW said it reported the issue in accordance with the vulnerability disclosure policy published by the EAC; after verification by the EAC team, the vulnerability was fixed before the upcoming U.S. federal midterm elections.

Source: TechFlow