Detections
Analytics
NewStart CGSL MAIN 6.06 : krb5 Multiple Vulnerabilities (NS-SA-2026-0063)
critical Nessus Plugin ID 330498
Synopsis
The remote NewStart CGSL host is affected by multiple vulnerabilities.Description
The remote NewStart CGSL host, running version MAIN 6.06, has krb5 packages installed that are affected by multiple vulnerabilities:- In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. (CVE-2024-37371)
- lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because
_xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. (CVE-2023-36054)
- In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
(CVE-2024-37370)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the vulnerable CGSL krb5 packages. Note that updated packages may not be available yet. Please contact ZTE for more information.See Also
https://security.gd-linux.com/info/CVE-2023-36054
https://security.gd-linux.com/info/CVE-2024-37370
Plugin Details
Severity: Critical
ID: 330498
File Name: newstart_cgsl_NS-SA-2026-0063_krb5.nasl
Version: 1.1
Type: Local
Published: 7/29/2026
Updated: 7/29/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.56
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C
CVSS Score Source: CVE-2024-37371
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:zte:cgsl_main:6, p-cpe:/a:zte:cgsl_main:krb5-devel, p-cpe:/a:zte:cgsl_main:krb5-libs, p-cpe:/a:zte:cgsl_main:libkadm5
Required KB Items: Host/local_checks_enabled, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 7/27/2026
Vulnerability Publication Date: 7/11/2023