Vista Net, Inc.

Call Directions Website Contact the business

Vista Net, Inc. Norther California's most trusted and experienced computer network integration and cloud specialists VistaNet Inc.

is Northern California's premier Network Integrator and Internet Service Provider specializing in technology solutions for corporate, education, government, and non-profits entities. We offer a complete line of products and services to meet the technology needs of every organization. As the North Valley's technology leader we continually strive to provide the highest level of technical support for our clients. From small peer to peer networks to large, complex enterprise networks and beyond, VistaNet is your technology partner.

https://lnkd.in/p/gGpey5Z2
09/13/2026

https://lnkd.in/p/gGpey5Z2

"Drop AI into your company and everything gets easier." That's the common pitch now. No integration plan, no owner, no failure mode, just sprinkle it on. It's the enterprise version of a diet pill ad. This promise will always require perfection. The summary will be right. The transcript will be comp...

VU #687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical di...
09/10/2026

VU #687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

Overview An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. When Secure Boot is disabled, this can be leveraged to execute arbitrary UEFI-level code before the operating system loads. This allows an attacker to bypass OS-level security controls, including HVCI, EDR solutions, and Microsoft Defender. The attack may also enable capture of BitLocker Volume Master Key (VMK) material, depending on the system's BitLocker configuration. Description AOMEI Backupper from AOMEI International Network Limited is designed to provide backup and disaster recovery services. It also helps individuals and businesses to create system images, disk clones, and file backups. AOMEI Backupper is available as a Windows application and can be integrated into enterprise backup workflows or directly used by end users. CVE-2026-12780: An Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in the amwrtdrv.sys kernel driver used by AOMEI Backupper 8.4.0 allows an unprivileged local attacker to achieve UEFI-level arbitrary code ex*****on by directly writing to physical disk devices. The driver creates a world-accessible device object without a security descriptor, therefore allowing any user-mode process to open the device and issue unrestricted write requests. Hence, an attacker can modify disk sectors in the pre-partition gap (LBA 34–2047), inject a malicious UEFI payload, and alter the GPT to reference the payload as an EFI System Partition. The payload can then execute during the UEFI Boot Device Selection (BDS) phase, before operating system security mechanisms are loaded. Impact An attacker with unprivileged local access to a system running AOMEI Backupper 8.4.0 can exploit this vulnerability by opening the world-accessible \.mwrtdrvDISK0 device object and sending specially crafted write commands to an arbitrary physical disk. When Secure Boot is disabled, a successful exploitation allows the attacker to inject UEFI code that executes before the Windows kernel loads, completely bypassing kernel-mode security features including Hyper-V Code Integrity (HVCI), Endpoint Detection and Response (EDR) solutions, Windows Defender, and Hyper-V isolation. On systems using BitLocker with TPM-only protection, this attack vector enables evil maid attacks whereby VMK credentials can be captured during the pre-boot phase Boot Device Selection (BDS) phase. Solution Please see the Vendor Information section for patches provided by AOMEI International Network Limited to address this issue. CERT/CC recommends that AOMEI Backupper users update to a version that includes the corrected amwrtdrv.sys driver and implements appropriate access controls. Users who cannot immediately apply the available update should consider uninstalling AOMEI Backupper. Alternatively, users may disable the amwrtdrv.sys service by changing its start type from AUTO_START to disabled. Enabling Secure Boot in UEFI firmware settings provides additional defense in depth by requiring signed bootloaders, but it does not address the underlying driver vulnerability. Acknowledgements Thank you to SiCk / afflicted.sh for reporting this vulnerability. This document was written by Vijay Sarvepalli.

Overview An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. When Secure Boot is disabled, this can be leveraged to execute arbitrary UEFI-level c...

VU #718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure BootOverview The UEFI Shell program may...
09/10/2026

VU #718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to modify UEFI boot configuration may be able to create multiple boot option entries and bypass controls intended to prevent the UEFI Shell from launching while Secure Boot is enabled. This could allow an attacker to modify the pre-boot environment and execute unauthorized software during system startup. Description The Unified Extensible Firmware Interface (UEFI) is a firmware specification that defines the interface between a computing platform's hardware and operating system (OS) during the early boot process before the operating system is loaded. UEFI Secure Boot helps ensure that only trusted and digitally signed software is executed during these early stages of platform initialization. The TianoCore EDK II project provides an open-source reference implementation of the UEFI and Platform Initialization (PI) specifications. The project includes the UEFI Shell, which provides command-line utilities for debugging, diagnostics, and advanced platform management. Many OEM and Independent BIOS Vendor (IBV) firmware implementations include the UEFI Shell in SPI flash for service and support purposes. Because the shell executes in the pre-boot environment, it provides powerful commands such as dmem (display memory) and mm (memory modify) that can access physical memory. Many implementations include a boot entry for the UEFI Shell but remove or suppress it when Secure Boot is enabled to reduce the risk of misuse. A vulnerability disclosed by Eclypsium researcher Stas Lyakhov details a technique in which an attacker with the ability to create additional UEFI boot entries can reference the UEFI Shell even when standard controls are implemented to prevent its ex*****on. An attacker could then exploit the UEFI Shell and its startup scripting capabilities to modify the pre-boot environment, including overwriting Secure Boot-related memory values, and execute unauthorized code during the early boot process. Impact An attacker capable of modifying UEFI boot entries may be able to circumvent intended Secure Boot protections and execute arbitrary code before the operating system loads. Code executed during the pre-boot phase may establish persistent access, including the ability to load malicious boot components or kernel-level software that can survive both system reboots and, in some cases, reinstallation of the operating system. Such activity may also reduce the effectiveness of OS-based security controls and endpoint detection and response (EDR) solutions. Solution Apply a Patch Please see the Vendor Information section for responses from vendors that have released updates addressing this issue. Updating UEFI firmware may require OEM-specific tools and deployment processes, as firmware updates are often managed separately from operating system patch management. Follow the guidance provided by your platform vendor when applying firmware updates. Recommendations for Enterprises Organizations should review Secure Boot configuration and platform security policies to help prevent or detect unauthorized modifications to UEFI boot entries. Changes to boot configuration should be monitored and audited where possible. Enterprises that use independent endpoint management solutions should consult their OEM vendors for guidance on integrating UEFI firmware updates into their existing firmware lifecycle and patch management processes. Acknowledgements Thanks to Stas Lyakhov from Eclypsium for reporting this vulnerability. This document was written by Vijay Sarvepalli....

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to modify...

VU #456290: Hugging Face Transformers library writes remote code to disk prior to consent checkOverview A vulnerability ...
09/10/2026

VU #456290: Hugging Face Transformers library writes remote code to disk prior to consent check

Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. Description Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code(). Although ex*****on of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious custom_generate/generate.py file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt. Impact The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended ex*****on of cached code. Solution At the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking load_custom_generate() with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (~/.cache/huggingface/modules) to remove unexpected content. Implementations should ensure that trust_remote_code checks occur prior to any remote content retrieval or local file writes. Acknowledgements Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer....

https://www.vistanetinc.com/vu456290-hugging-face-transformers-library-writes-remote-code-to-disk-prior-to-consent-check/?utm_source=facebook&utm_medium=jetpack_social

Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust...

VU #859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerabilityOverview Skullc...
09/10/2026

VU #859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Overview Skullcandy Dime 3 wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic (BR/EDR) pairing request from an unpaired device without requiring the earbuds to be placed into pairing mode or requiring any physical confirmation or interaction from the owner. Description The Skullcandy Dime 3 (Model S2DCW) wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic (BR/EDR) pairing request from a previously unpaired device without the device being placed into pairing mode by the owner and without physical confirmation on the earbuds. The device's Bluetooth PnP modalias identifies the chipset vendor as Airoha Technology Corp. (Bluetooth SIG company ID 0x0094). This vulnerability was previously disclosed in CVE-2025-20701 and is described as: In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional ex*****on privileges needed. User interaction is not needed for exploitation. An attacker is required to be within Bluetooth radio range to the target earbuds, but no prior pairing, physical access, or interaction with the earbuds' buttons or case is required to exploit the vulnerability. A direct pairing request to the earbuds' known or discovered Bluetooth Classic address can be sent without a PIN, passkey, or physical confirmation. The pairing/bonding completes without owner action due to the device's NoInputNoOutput I/O capability. The firmware version displayed on the affected Skullcandy Dime 3 wireless earbuds is 1.0.0.28. Impact Once bonded, the attacker's device is added as a trusted device and can reconnect automatically whenever in range. This allows an attacker to establish an A2DP audio transport, which interrupts the legitimate user's active connection to their own device. The only indication to the legitimate user is an audible "New device paired" notification, given after the unauthorized pairing has already succeeded, providing no opportunity to block it in advance. This could allow an attacker to hijack the audio session or, depending on device capabilities, potentially access other services exposed over the same Bluetooth Classic connection. An attacker can also access the Dime 3's Hands-Free/Headset profile and capture live microphone audio. Solution The vendor considers the CVE-2025-20701 patch in version 1.0.0.30 to be effective. However, Skullcandy confirmed that the Dime 3 does not support firmware updates through the Skullcandy application. Existing units running the vulnerable firmware cannot currently be updated by customers through the app. As of this writing, there are no known consumer-accessible methods to update an existing unit from the affected firmware version 1.0.0.28 to version 1.0.0.30. Acknowledgements Thank you to Jacob Nowak for reporting this vulnerability. This document was written by Bob Kemerer....

Overview Skullcandy Dime 3 wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic (BR/EDR) pairing request from an unpaired device without requiring the earbuds to be placed into pairing mode or requiring any physical confirmation or interaction from the owner. Descripti...

VU #943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerabilityOverview A...
09/10/2026

VU #943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the ownCloud server into issuing arbitrary network requests to attacker‑controlled destinations. Description The ownCloud ecosystem delivers a platform for enterprise file collaboration, providing capabilities for storing, syncing, and sharing data across devices. Ascensio System SIA's ONLYOFFICE provides a connector that integrates with ownCloud, enabling users to open and edit files directly within the cloud storage environment. When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. As detailed in CVE-2026-84282, the application does not restrict or sanitize this parameter, allowing an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages (such as connection failures versus SSL/TLS negotiation errors) enable the attacker to distinguish between open and closed TCP ports, facilitating internal network reconnaissance and port enumeration. The outbound requests originate from the ownCloud server, demonstrating server‑side request ex*****on consistent with an SSRF vulnerability. This vulnerability could allow an attacker to abuse the ownCloud server infrastructure as a proxy to send malicious content to targeted systems. Impact Successful exploitation allows an authenticated administrator to: * Trigger arbitrary outbound network requests from the ownCloud server (SSRF). * Access and probe localhost services (127.0.0.1) not reachable externally. * Perform internal network reconnaissance and port scanning. * Identify open and closed TCP ports through response‑based side channels. * Increase the attack surface for potential follow‑on exploitation of internal services. Solution Unfortunately, the vendor could not be reached to coordinate this vulnerability. While an official patch is not available at this time, there are a few general recommendations that may help mitigate this vulnerability. Disable or remove the plugin until a patched version is released. Network‑level egress controls should be applied to limit outbound connections from the ownCloud server to authorized destinations only. Acknowledgements Thank you to Nguyen Huy Hoang, Nguyen Vu Long and Nguyen Tien Dat of ETC JSC for reporting this vulnerability. This document was written by Bob Kemerer....

Overview A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authentic...

VU #889462: Casdoor authentication server is vulnerable to authorization bypassOverview Casdoor is an open-source Access...
09/10/2026

VU #889462: Casdoor authentication server is vulnerable to authorization bypass

Overview Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against arbitrary organizations by exploiting inconsistent object resolution between the authorization layer and downstream controllers. In multi-tenant deployments, an attacker with administrative privileges within a single organization can bypass tenant isolation and perform administrative operations against other organizations. Description CVE-2026-15630. The vulnerability stems from a desynchronization between authorization and action in multiple POST /api/add,delete- endpoints (e.g., /api/add-user, /api/delete-user, /api/add-permission). While the global authorization filter (routers/authzfilter.go) correctly uses the ?id= URL query parameter as the authoritative target for authorization decisions, the affected controllers (controllers/user.go, controllers/permission.go, etc.) ignore ?id= and operate solely on the owner and name fields in the JSON request body. As a result, authorization is evaluated against one object while the requested operation is executed against another, allowing an authenticated organization administrator (IsAdmin=true) to perform unauthorized administrative actions across tenant boundaries. Impact An attacker with administrative privileges in a single organization can compromise the isolation guarantees of a multi-tenant Casdoor deployment. Depending on the exposed endpoints and deployment configuration, successful exploitation can allow for administrative operations including user management, privilege management and disruption of single sign-on (SSO) or Security Assertion Markup Language (SAML) identity. The overall impact can escalate to a complete compromise of tenant isolation and, in some deployment scenarios, potential compromise of the entire Casdoor instance. Solution Unfortunately, we were unable to reach Casdoor to coordinate this vulnerability. Therefore, at the time of this publication, no vendor patch is known to be available. If upgrading to a fixed release is not yet possible, organizations can consider the following mitigations: Enforce least privilege by minimizing the number of accounts with IsAdmin=true, disabling any workflows that automatically grant admin privilege Require multi-factor authentication (MFA) for all administrative accounts and/or administrative actions Alert on cross-organization administrative activity, including: Creation of administrator accounts Deletion of users belonging to other organizations Modification of permissions across organizational boundaries using wildcard resources=[""] or actions=[""] permissive Casbin rules. Investigate unexplained reductions in user counts or administrative objects within any organization. Acknowledgements Thank you to Louis Sanchez of Voke Cyber for reporting this vulnerability. This document was written by Alexander Curtis....

Overview Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions aga...

Address

669 Palmetto Avenue Suit E
Chico, CA
95926

Opening Hours

Monday 8am - 5pm
Tuesday 8am - 5pm
Wednesday 8am - 5pm
Thursday 8am - 5pm
Friday 8am - 5pm

Telephone

+15308918555

Website

Alerts

Be the first to know and let us send you an email when Vista Net, Inc. posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Vista Net, Inc.:

Shortcuts

Share