« Volver al listado

CVE-2026-49942

Estado: AnalizadaAlta (7.3)—

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.

The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.

Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Validación deficiente en máscaras de red (CWE-1289) permite aceptar redes más amplias de lo previsto; explotable remotamente sin autenticación. Posibilita manipulación de controles de acceso en redes (ACL bypass) y suplantación de identidad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementPassword PoliciesNetwork SegmentationMulti-factor AuthenticationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Rrwo — Net\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-49942",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49942",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-04T17:42:08.928858Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/robrwo/perl-Net-CIDR-Set",
          "vendor": "RRWO",
          "product": "Net::CIDR::Set",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "0.20"
            }
          ],
          "packageName": "Net-CIDR-Set",
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Net::CIDR::Set::IPv4::_encode"
            },
            {
              "name": "Net::CIDR::Set::IPv6::_encode"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-04T17:16:33.283",
  "references": [
    {
      "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes",
      "tags": [
        "Release Notes"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45191",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1289"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.\n\nThe mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored.   This could allow network masks to accept larger networks.\n\nLeading zeros were also accepted, but treated as decimal instead of octal.  This could lead to confusion about what networks are acceptable."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::CIDR::Set hasta la 0.20 para Perl no validaban las máscaras de red.\n\nLa porción de máscara de una máscara de red podía contener dígitos Unicode como el Uno arábigo-índico (U+0661), o no-dígitos, los cuales eran ignorados. Esto podría permitir a las máscaras de red aceptar redes más grandes.\n\nLos ceros iniciales también eran aceptados, pero tratados como decimal en lugar de octal. Esto podría llevar a confusión sobre qué redes son aceptables."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rrwo:net\\:\\:cidr\\:\\:set:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24C7BD24-8729-408F-BD1D-F8F0608DFE50",
              "versionEndExcluding": "0.21"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}