{"id":"CVE-2026-105979","kind":"vulnerability","aliases":["CVE-2026-105979"],"related":[],"title":"ZeroTier VPN: input validation flaw lets a privileged remote attacker run root commands","description":"Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","summary":"ZeroTier's VPN function fails to validate input properly, so a remote attacker with high privileges can inject system commands. Those commands run with root privileges on the affected machine.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","macos","vpn","windows","zerotier"],"not_affected_if":["low-privilege-accounts-only","zerotier-not-installed","zerotier-vpn-feature-disabled"],"how_to_check":"Unconfirmed. The affected vendor and versions are not yet published. Do not rely on zerotier-cli: the CVE description says 'ZeroTier VPN function', which may be a feature of a device's firmware rather than the ZeroTier client. Check whether any industrial router or gateway you run has a ZeroTier VPN feature enabled, and watch certvde.com/en/advisories (CNA: CERT@VDE) for the vendor advisory.","fix":null,"status":"open","published_at":"2026-11-03T09:17:09+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:15+00:00","updated_at":"2026-11-03T09:22:08+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-03T09:20:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ZeroTier VPN: input validation flaw lets a privileged remote attacker run root commands","impact":"high","summary":"ZeroTier's VPN function fails to validate input properly, so a remote attacker with high privileges can inject system commands. Those commands run with root privileges on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zerotier","vpn","linux","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs system commands as root on the host.","analyst_note":"Find the affected and fixed ZeroTier version ranges and the exact VPN feature involved in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105979.","how_to_check":"- Check the installed ZeroTier version with `zerotier-cli info` and compare it against the affected ranges in the NVD entry.\n- Confirm whether the ZeroTier service is running on the host with `zerotier-cli status`.","plain_action":"","needs_analyst":true,"not_affected_if":["zerotier-not-installed","low-privilege-accounts-only"],"who_is_affected":"Systems running the ZeroTier VPN function are the ones to look at. The sources do not say which versions are affected or which configurations are exposed, and the attacker must already hold high privileges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4071,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed ZeroTier version ranges and the exact VPN feature involved in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105979.","search":"'-105979':16A,19A '-2026':15A,18A 'affect':54B 'allow':65C 'attack':10A,38B,68C 'command':13A,45B,47B,75C 'cve':14A,17A 'execut':77C 'fail':30B 'flaw':5A 'function':29B,63C 'high':40B,70C 'improp':56C 'infrastructur':20B 'inject':43B,73C 'input':3A,33B,57C 'let':6A 'linux':21B 'machin':55B 'maco':22B 'may':64C 'privileg':8A,41B,51B,71C,81C 'proper':34B 'remot':9A,37B,67C 'root':12A,50B,80C 'run':11A,48B 'system':44B,74C 'valid':4A,32B,58C 'vpn':2A,23B,28B,62C 'window':24B 'zeroti':1A,25B,26B,61C","nicknames":[],"mitigations":[],"who_affected":"The description only says a remote attacker with high privileges (an admin-level account) can inject commands through a ZeroTier VPN function and run them as root. No source read so far names the product, vendor or versions. CERT@VDE is the CNA, so the likely targets are industrial or embedded devices with a ZeroTier VPN feature. Systems with no ZeroTier VPN feature, or where no untrusted party holds admin rights, are the lower priority.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","linux","macos","vpn","windows","zerotier"],"first_public_at":"2026-11-03T09:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105979","severity":null,"published_at":"2026-11-03T09:17:09+00:00","modified_at":"2026-11-03T09:17:09+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105979:1476","url":null,"severity":null,"published_at":"2026-11-03T09:22:08+00:00","modified_at":"2026-11-03T09:22:08+00:00","first_seen_at":"2026-11-03T09:22:08+00:00","fetched_at":"2026-11-03T09:22:08+00:00","note":"NVD page returns no record text; CVE id found on no other page. CNA is CERT@VDE (info@cert.vde.com), so likely an industrial device vendor's firmware with a ZeroTier VPN feature, not ZeroTier Inc's client. Not the InHand CVE-2026-38703 (different id, unauthenticated, fixed in 3.5.112). Vendor, versions and fix unknown; check certvde.com/en/advisories for the VDE advisory once published."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}