The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_53845 advisory.

    * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)

    * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

    Bug Fix(es) and Enhancement(s):

    * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as fw, although it should be static.
    [rhel-10.2.z] (JIRA:Rocky Linux-191899)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the open-iscsi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-     iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into     the record.






    This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

    A stack buffer overflow vulnerability exists in the idbm_recinfo_config() function in open-iscsi (iscsi-     initiator-utils). An attacker can craft a malicious SendTargets TargetName containing newline characters     and oversized injected keys or values to inject extra configuration lines into persisted node records.
    When the record is reparsed, due to missing bounds checking, a stack buffer overflow occurs, leading to     denial of service or potential memory corruption. The affected component is usr/idbm.c:idbm_recinfo_config     in iscsi-initiator-utils, with attacker-controlled input reaching it through SendTargets handling in     usr/discovery.c.(CVE-2026-18724)

Tenable has extracted the preceding description block directly from the EulerOS open-iscsi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the open-iscsi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A stack buffer overflow vulnerability exists in the idbm_recinfo_config() function in open-iscsi (iscsi-     initiator-utils). An attacker can craft a malicious SendTargets TargetName containing newline characters     and oversized injected keys or values to inject extra configuration lines into persisted node records.
    When the record is reparsed, due to missing bounds checking, a stack buffer overflow occurs, leading to     denial of service or potential memory corruption. The affected component is usr/idbm.c:idbm_recinfo_config     in iscsi-initiator-utils, with attacker-controlled input reaching it through SendTargets handling in     usr/discovery.c.(CVE-2026-18724)

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-     iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into     the record.






    This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

Tenable has extracted the preceding description block directly from the EulerOS open-iscsi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-004b11bc1e advisory.

    Automatic update for iscsi-initiator-utils-6.2.1.12-1.fc45.

    ##### **Changelog**

    ```
    * Wed Jul 29 2026 Chris Leech <cleech@redhat.com> - 6.2.1.12-1
    - rebase to Open-iSCSI 2.1.12
    - CVE-2026-44943: Privilege Escalation via Path Traversal (rhbz#2508458)
    - CVE-2026-44944: Authentication bypass in iscsiuio control socket       (rhbz#2508457)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53844 advisory.

    * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)

    * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

    Bug Fix(es) and Enhancement(s):

    * [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as fw, although it should be static.
    [rhel-9.8.z] (JIRA:Rocky Linux-191897)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2066 advisory.

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-     iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into     the record.





    This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. (CVE-2026-44943)

    An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the     isscsiuio control socket.





    This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. (CVE-2026-44944)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
359458	Rocky Linux 10.2 [CIQ] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_53845)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
364827	EulerOS 2.0 SP13 : open-iscsi (EulerOS-SA-2026-4075)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	medium
364914	EulerOS 2.0 SP13 : open-iscsi (EulerOS-SA-2026-4166)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	medium
364962	EulerOS 2.0 SP11 : open-iscsi (EulerOS-SA-2026-4350)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	medium
331293	Fedora 45 : iscsi-initiator-utils (2026-004b11bc1e)	Nessus	Fedora Local Security Checks	2026/7/30	2026/7/30	high
334838	RockyLinux 9 : iscsi-initiator-utils (RLSA-2026:53844)	Nessus	Rocky Linux Local Security Checks	2026/8/12	2026/8/12	high
337203	Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2066)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/18	high

检测

插件搜索

high

medium

medium

medium

high

high

high