Detections
Analytics
NewStart CGSL MAIN 7.02 : containerd Multiple Vulnerabilities (NS-SA-2026-0097)
critical Nessus Plugin ID 343597
Synopsis
The remote NewStart CGSL host is affected by multiple vulnerabilities.Description
The remote NewStart CGSL host, running version MAIN 7.02, has containerd packages installed that are affected by multiple vulnerabilities:- containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10. (CVE-2026-53488)
- containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources. (CVE-2025-64329)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the vulnerable CGSL containerd packages. Note that updated packages may not be available yet. Please contact ZTE for more information.See Also
https://security.gd-linux.com/info/CVE-2025-64329
Plugin Details
Severity: Critical
ID: 343597
File Name: newstart_cgsl_NS-SA-2026-0097_containerd.nasl
Version: 1.1
Type: Local
Published: 9/8/2026
Updated: 9/8/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.06
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-53488
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.4
Threat Score: 7.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
CPE: cpe:/o:zte:cgsl_main:7, p-cpe:/a:zte:cgsl_main:containerd
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 9/7/2026
Vulnerability Publication Date: 11/6/2025
Reference Information
CVE: CVE-2025-64329, CVE-2026-53488
IAVA: 2025-A-0832-S, 2026-A-0621