{"id":"CVE-2026-115646","published":"2026-11-10T05:17:48.627","lastModified":"2026-11-10T20:18:04.317","description":"Partial String Comparison Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-187"],"vendors":[],"products":[],"references":[{"url":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-165/index.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"HiRDB contains a partial string comparison vulnerability (CWE-187) that may allow an unauthenticated remote attacker to bypass authentication or authorization checks by exploiting incomplete string validation during credential or permission verification. This flaw is critical due to its network-exploitable nature and full confidentiality, integrity, and availability impact.","exploitability":"Exploitation requires no prior access, user interaction, or special conditions, but the exact attack vector remains unspecified in the public description.","blast_radius":"Successful exploitation could enable full system compromise including unauthorized data access, modification, or service disruption across all affected HiRDB instances.","remediation":"Upgrade HiRDB Server Version 10 to 10-12-01 or later; upgrade HiRDB Server Version 9 to a version newer than 09-66-22; upgrade HiRDB Server with Additional Function Version 9 to a version newer than 09-66-/V; upgrade HiRDB Server Version 9(32) to a version newer than 09-66-22; upgrade HiRDB Server with Additional Function Version 9(32) to a version newer than 09-66-/V.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["partial-string-comparison","auth-bypass","remote-exploit","db-vulnerability"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:45:15.353Z"}}