{"id":"CVE-2026-59107","kind":"vulnerability","aliases":["CVE-2026-59107"],"related":[],"title":"vSolution Matrix: shared key lets attacker log in over SSH as root","description":"A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.","summary":"A shared cryptographic trust setting in the vSolution Matrix file sharing feature lets an attacker who holds the matching private key authenticate to the device over SSH as root. Only devices set up as a Matrix main/master station with file sharing enabled are affected.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","ssh","vsolution-matrix"],"not_affected_if":["file-sharing-disabled","not-main-master-station"],"how_to_check":"- Check whether the device is configured as a vSolution Matrix main/master station with the file sharing feature enabled (unknown vendor path or setting; the sources do not say)\n- Review SSH authorized keys and trust configuration for the file sharing feature (unknown; the sources do not say)","fix":"- unknown (the sources do not give a patched version or vendor advisory; check the vendor for a firmware update and disable file sharing until one is applied)","status":"open","published_at":"2026-10-26T14:16:38+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","triaged_at":"2026-10-26T14:31:59+00:00","updated_at":"2026-10-26T14:31:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T14:31:59Z","model":"claude-haiku-5-5","output":{"fix":"- unknown (the sources do not give a patched version or vendor advisory; check the vendor for a firmware update and disable file sharing until one is applied)","reach":"network","title":"vSolution Matrix: shared key lets attacker log in over SSH as root","impact":"high","summary":"A shared cryptographic trust setting in the vSolution Matrix file sharing feature lets an attacker who holds the matching private key authenticate to the device over SSH as root. Only devices set up as a Matrix main/master station with file sharing enabled are affected.","category":"infrastructure","nicknames":[],"who_cares":["vsolution-matrix","ssh","embedded"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker gets root shell on the device over SSH.","analyst_note":"Find the vendor advisory and patched firmware version; the NVD entry gives no versions or vendor link beyond the CVE itself.","how_to_check":"- Check whether the device is configured as a vSolution Matrix main/master station with the file sharing feature enabled (unknown vendor path or setting; the sources do not say)\n- Review SSH authorized keys and trust configuration for the file sharing feature (unknown; the sources do not say)","needs_analyst":true,"not_affected_if":["file-sharing-disabled","not-main-master-station"],"who_is_affected":"Only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled are affected, according to the NVD description. Devices without that role or with file sharing turned off are not described as affected. Teams running other products can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000622,"input_tokens":3320,"output_tokens":579,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59107':15A,18A 'affect':68B,101C,109C 'allow':88C 'attack':6A,39B,90C 'authent':46B,98C 'configur':86C,112C 'could':87C 'cryptograph':27B,84C 'cve':13A,16A 'devic':49B,55B,102C,111C 'embed':19B 'enabl':66B,124C 'featur':36B,81C,123C 'file':34B,64B,79C,121C 'hold':41B 'identifi':74C 'infrastructur':20B 'key':4A,45B,96C 'let':5A,37B 'log':7A 'main/master':61B,117C 'match':43B,94C 'matrix':2A,24B,33B,60B,78C,116C 'obtain':92C 'privat':44B,95C 'root':12A,53B,106C 'secur':70C 'set':29B,56B 'share':3A,26B,35B,65B,80C,83C,122C 'ssh':10A,21B,51B,104C 'station':62B,118C 'trust':28B,85C 'via':103C 'vsolut':1A,23B,32B,77C,115C 'vsolution-matrix':22B 'vulner':71C,108C","nicknames":[],"mitigations":[],"who_affected":"Only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled are affected, according to the NVD description. Devices without that role or with file sharing turned off are not described as affected. Teams running other products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59107","severity":null,"published_at":"2026-10-26T14:16:38+00:00","modified_at":"2026-10-26T14:16:38+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}