What is the official website of Arrow Systems Integration ?

The official website of Arrow Systems Integration is http://www.arrowsi.com/.

What is Arrow Systems Integration's cybersecurity risk score?

Arrow Systems Integration has an AI-generated cybersecurity risk score of 754 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Arrow Systems Integration experienced?

According to Rankiteo, Arrow Systems Integration currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Arrow Systems Integration been affected by any supply chain cyber incidents ?

According to Rankiteo, Arrow Systems Integration has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does Arrow Systems Integration have SOC 2 Type 1 certification ?

According to Rankiteo, Arrow Systems Integration is not certified under SOC 2 Type 1.

Does Arrow Systems Integration have SOC 2 Type 2 certification ?

According to Rankiteo, Arrow Systems Integration does not hold a SOC 2 Type 2 certification.

Does Arrow Systems Integration comply with GDPR ?

According to Rankiteo, Arrow Systems Integration is not listed as GDPR compliant.

Does Arrow Systems Integration have PCI DSS certification ?

According to Rankiteo, Arrow Systems Integration does not currently maintain PCI DSS compliance.

Does Arrow Systems Integration comply with HIPAA ?

According to Rankiteo, Arrow Systems Integration is not compliant with HIPAA regulations.

Does Arrow Systems Integration have ISO 27001 certification ?

According to Rankiteo,Arrow Systems Integration is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Arrow Systems Integration operate in ?

Arrow Systems Integration operates primarily in the Telecommunications industry.

How many employees does Arrow Systems Integration have ?

Arrow Systems Integration employs approximately 144 people worldwide.

Does Arrow Systems Integration own any subsidiaries ?

Arrow Systems Integration presently has no subsidiaries across any sectors.

How many LinkedIn followers does Arrow Systems Integration have ?

Arrow Systems Integration's official LinkedIn profile has approximately 1,829 followers.

What is the NAICS classification code for Arrow Systems Integration ?

Arrow Systems Integration is classified under the NAICS code 517, which corresponds to Telecommunications.

Does Arrow Systems Integration have a Crunchbase profile ?

No, Arrow Systems Integration does not have a profile on Crunchbase.

Does Arrow Systems Integration have a LinkedIn profile ?

Yes, Arrow Systems Integration maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/arrow-systems-integration.

How many cybersecurity incidents has Arrow Systems Integration experienced ?

As of October 20, 2026, Rankiteo reports that Arrow Systems Integration has experienced 1 cybersecurity incidents.

How many peer or competitor companies does Arrow Systems Integration have ?

Arrow Systems Integration has an estimated 10,395 peer or competitor companies worldwide.

What types of cybersecurity incidents has Arrow Systems Integration faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

ASI

Boost Score +25 with badge (5 left)

754

/1000

Fair

779

/1000

Fair

Arrow Systems Integration Vendor Cyber Rating & Cyber Score

arrowsi.com

Add Your Compliance Badge

Our long-term partnerships with the leading manufacturers of voice and data technology in North America enable us to recommend proven, business transforming solutions including unified communications, voice and data technologies, contact center and network security. We believe that a company's growth and profitability should be built upon a foundation of employee empowerment and a commitment to the customer and we continue in our legacy of making communications technology the best it can be through unmatched technical expertise and depth. Whether educating clients on the latest technology, implementing a solution or providing consultative services, Arrow Systems Integration (Arrow SI) offers the products, solutions and industry experts

ASI

Arrow Systems Integration CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Arrow Systems Integ...

Breach

2/2010

ARR408070825

Loading…

A.I.

ASI Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for ASI

Incidents vs Telecommunications Industry Avg (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incident Types ASI vs Telecommunications Industry Avg (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incident History - ASI (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Arrow Systems Integration Subsidiaries

ASI

Telecommunications

Website: http://www.arrowsi.com/

Company Size: 1,001-5,000 employees

Arrow ElectronicsTechnology, Information and Internet

SiliconExpertTechnology, Information and Internet

SiliconExpert GermanyIT Services and IT Consulting

SiliconExpert ItalyIT Services and IT Consulting

SiliconExpert FranceIT Services and IT Consulting

ConvergeSemiconductor Manufacturing

Converge FOMComputer Hardware Manufacturing

Arrow ECS EMEAInformation Technology & Services

Arrow ECS End User ComputingIT Services and IT Consulting

Arrow ECS FranceIT Services and IT Consulting

Arrow Security SolutionsIT Services and IT Consulting

Arrow ECS SpainIT Services and IT Consulting

Arrow ECS United KingdomInformation Technology & Services

The IT InsiderIT Services and IT Consulting

Arrow Cloud UK & IrelandIT Services and IT Consulting

Arrow ECS North AmericaIT Services and IT Consulting

immixGroupIT Services and IT Consulting

Arrow Electronics ItaliaIT Services and IT Consulting

Arrow ECS SwedenIT Services and IT Consulting

Arrow ECS Education SwedenIT-tjänster och IT-konsulttjänster

Richardson RFPDSemiconductor Manufacturing

Richardson RFPD Global IoT SolutionsWireless Services

Arrow Intelligent SolutionsInformation Technology & Services

Arrow ECS DenmarkInformation Technology & Services

Arrow ECS Education - DenmarkInformation Technology & Services

Arrow ECS AustriaComputer and Network Security

Arrow ECS ANZIT Services and IT Consulting

Arrow ECS CloudIT Services and IT Consulting

Arrow Asia Pac LtdIT Services and IT Consulting

Arrow ECS Norway ASIT Services and IT Consulting

Arrow ECS Education NorwayIT-tjenester og -rådgivning

Arrow ECS PortugalInformation Technology & Services

Arrow ECS BeLuxInformation Technology & Services

Arrow BeLux - IBM FlashSystemIT Services and IT Consulting

Arrow Aerospace and Defense | Zeus & A.E. PetscheAviation and Aerospace Component Manufacturing

NIC Components Corp.Appliances, Electrical, and Electronics Manufacturing

Arrow NederlandIT Services and IT Consulting

A.E. PetscheDefense and Space Manufacturing

Arrow ECS PolskaIT Services and IT Consulting

Arrow Electronics IberiaSemiconductor Manufacturing

VericalAppliances, Electrical, and Electronics Manufacturing

Arrow ECS Finland OyIT Services and IT Consulting

Arrow vLounge FinlandInformation Technology & Services

Arrow Electronics TürkiyeToptan Satış Beyaz Eşya, Elektrikli ve Elektrik ve Elektronik Eşya

Arrow ECS Moroccoالخدمات والاستشارات في مجال تكنولوجيا المعلومات

Arrow ECS HungaryIT Services and IT Consulting

Transim TechnologySoftware Development

Arrow ECS Czech RepublicIT Services and IT Consulting

Arrow ECS Education Czech RepublicIT služby a IT poradenství

Arrow ECS Education ServicesIT Services and IT Consulting

Loading…

Arrow Systems Integration Similar Companies

Telekom Malaysia

tm.com.my

TM is the national connectivity and digital infrastructure provider and Malaysia’s leading integrated telco; offering a comprehensive suite of communication services and solutions in fixed (telephony and broadband), mobility, content, WiFi, ICT, Cloud and smart services. TM is driven by stakeholder value creation in a highly competitive environment and places, emphasis on delivering an enhanced customer experience via continuous customer service quality improvements and innovations, whilst focusing on increased operational efficiency and productivity. As the enabler of the nation’s Digital Malaysia aspiration, TM has been at the forefront of every telecommunications technology evolution in the country and will continue to do so. It provides the communications backbone of Malaysia with the widest connectivity and convergence network. TM remains committed to expanding its network with a comprehensive digital infrastructure. Moving beyond connectivity services, TM is developing new value-added digital services to cater to a more digital lifestyle and society, digital businesses, and digital government, striving to make “Life and Business Easier, for a better Malaysia.” For further information on TM, visit www.tm.com.my. . SSM: 128740-P

PT. Indosat Tbk

ioh.co.id

Indosat Ooredoo Hutchison (IDX: ISAT) ("IOH"), are here with our vision to become the most preferred digital telecommunications company of Indonesia. The IOH merger combines two highly complementary businesses between PT Indosat Tbk (“Indosat Ooredoo”) and PT Hutchison 3 Indonesia to create a new world-class digital telecoms and internet company for Indonesia that can better compete and create additional value for all stakeholders, including employees, customers, and shareholders. Indosat Ooredoo Hutchison is now the second-largest mobile telecoms business in Indonesia. Indosat Ooredoo Hutchison will be guided by its corporate vision “To Become the Most Preferred Digital Telco of Indonesia” to capture the tremendous market opportunities presented by Indonesia’s digital and economic growth. The Company’s enhanced scale, financial strength, and expertise, combined with its preeminent networks, talent, and strategic partnerships, will enable Indosat Ooredoo Hutchison to become a key telco player driving Indonesia’s digital transformation agenda. The Company will focus on its core mission of delivering world-class digital experiences while connecting and empowering every Indonesian.

Bouygues Telecom

cb bouyguestelecom.fr

🤝Ce qui fait notre singularité ? Chez Bouygues Telecom, nous croyons que les relations humaines sont un besoin vital. La qualité de nos relations avec notre famille, nos amis, ceux qui nous entourent est déterminante pour notre bien-être, notre santé et même notre espérance de vie. Ce sont ces relations qui nous épanouissent, nous font aller de l’avant et nous permettent de vivre plus heureux, plus longtemps. C’est pourquoi depuis notre création en 1996, les équipes Bouygues Telecom mettent toute leur énergie pour que la technologie soit avant tout au service de vos relations. Nous souhaitons agir pour faire grandir les relations humaines. En permettant à tous sans exception de garder le contact avec ses proches et la société. En devenant une source d’inspiration qui donne à chacun l’envie d’enrichir et d’améliorer la qualité de ses relations. Nos 10 500 collaborateurs relèvent tous ensemble au quotidien ce même défi : être engagés pour un numérique qui nous réunit. 💼 Nos métiers ? Quelles que soient vos aspirations il y aura forcément un métier pour vous chez Bouygues Telecom ! Plus de 150 métiers interagissent tous les jours : Télécom / Réseau, IT, Big Data, Innovation, Marketing, Commerce, Finance, Achats, Juridique… Nous avons besoin de tous les talents pour accomplir notre mission; car c’est cette richesse de profils et de compétences qui fait la qualité de nos services et contribue à la satisfaction de nos clients. 👉Alors si... Vous avez envie de mettre votre talent au service du développement numérique pour tous et de faire grandir les relations humaines : vous frappez à la bonne porte. Vous rêvez d’une entreprise qui donne le meilleur d’elle-même pour que vous puissiez donner le meilleur à votre tour : alors bienvenue ! #OnEstFaitPourEtreEnsemble

Telmex

telmex.com

TELMEX, la empresa líder de telecomunicaciones y servicios TI en México, ha realizado importantes inversiones para desarrollar la plataforma tecnológica más robusta y vanguardista del país, que le permite ofrecer la más amplia gama de soluciones, con los mayores estándares de calidad, seguridad, confiabilidad y competitividad; por ello, es el mejor socio estratégico en servicios avanzados de telecomunicaciones y TI. Las Soluciones TI de TELMEX van desde la Conectividad hasta Servicios de Nube, Centros de Datos, Ciberseguridad, Colaboración y Soluciones de Negocio. Un portafolio enfocado a cubrir las necesidades y proporcionar atención en infraestructura y procesos, lo que permite a los clientes aprovechar al máximo su inversión en tecnología, mientras evolucionan hacia nuevos sistemas y plataformas como servicio. TELMEX permite desarrollar e implementar proyectos en empresas de cualquier tamaño y en cualquier vertical de industria, ofreciendo soluciones integrales, innovadoras y de clase mundial, a través de tecnología de punta; brindando conectividad soportada por la mayor cobertura nacional e internacional y anchos de banda que garantizan la continuidad de las operaciones de sus clientes.

Zain Group

zain.com

Zain Group is a leading provider of innovative ICT technologies & digital lifestyle communications operating in 8 markets across the Middle East & Africa, serving 51.3 million active customers as of 30 September 2025. Zain provides mobile voice, data and B2B services in: Kuwait, Bahrain, Iraq, Jordan, Saudi Arabia, Sudan and South Sudan. Headquartered in the UAE, ZainTECH, the Group’s one-stop digital and ICT solutions provider, is playing a key role in the digital transformation of enterprise and government clientele across the MENA region. Also UAE based, Zain Omantel International (ZOI) is revolutionizing the international telecommunications wholesale landscape as the premier wholesale powerhouse serving regional operators, international carriers, and global hyperscalers. In Morocco, Zain has a 15.5% stake in ‘INWI’, through a joint venture. Zain is listed on the Boursa Kuwait (stock ticker: ZAIN). We recommend the Investor Community to download the “Zain Group Investor Relations” Mobile App. For more, please email [email protected]

TIM

gruppotim.it

We are driving the digital transition of Italy and Brazil with innovative technologies and services because we want to contribute to accelerating the sustainable growth of the economy and society by bringing value and prosperity to people, companies and institutions. We offer diversified solutions that meet the needs of our stakeholders while also integrating climate strategy, circular economy and digital growth targets. TIM offers fixed and mobile telephony services and products for communication and entertainment for individuals and households, and supports small and medium-sized enterprises in their path towards digitalisation with a portfolio tailored to their needs. Cloud, IoT and Cybersecurity technologies are at the heart of TIM Enterprise's End-to-End solutions for companies and the public institutions that support the country's digital transformation by making use of the largest data centre network in Italy, the expertise of Group companies such as Noovle, Olivetti and Telsy, and partnerships with leading industrial groups. We develop 4G and 5G mobile network and fibre network infrastructure, that we make available to the entire market, both through a widespread national presence and intentionally through Sparkle. In Brazil, TIM Brasil is a major player in the South American communications market and a leader in 4G and 5G coverage. We also support projects of high social interest via TIM Foundation in Italy and Instituto TIM in Brazil. The values that both unite and distinguish us are passion and courage, which help us to seize the challenges of the market, inclusion, because it creates value for the entire society, and finally integrity, to deserve and maintain the trust of our stakeholders.

ZTE Corporation

zte.com.cn

ZTE connects the world with continuous innovation for a better future. The company provides innovative technologies and integrated solutions, and its portfolio spans communication networks, computing infrastructure, industry digital solutions, and personal and home smart terminals. Serving one third of the world's population, ZTE is dedicated to leading globally in connectivity and intelligent computing, enabling communication and trust everywhere. ZTE is listed on both the Hong Kong and Shenzhen Stock Exchanges. For enquiry about our mobile devices, please contact us via [email protected] For network services, please contact our 24/7 support hotline: 0086-755-26771900 or email: [email protected] https://twitter.com/ZTEPress https://www.facebook.com/ZTECorp https://youtube.com/@ZTECorporation

Cox Communications

cb cox.com

Cox Communications is committed to creating more moments of real human connection. We bring people closer to family and friends through technology that’s inspired by a culture that puts people first, and we’re always working to improve life in the communities we serve. Our world-class broadband applications and services are helping create smart homes and smart cities that will bring more comfort, convenience, security, entertainment and connectivity to the lives of the people we serve. Our company is full of dreamers and doers; people who make plans and who make things happen. And, of course, people who have fun doing it. In short, people like you. Join the Cox team and make your mark!

T-Mobile

t-mobile.com

As the supercharged Un-carrier, T-Mobile US, Inc. (NASDAQ: TMUS) is powered by an award-winning 5G network that connects more people, in more places, than ever before. With T-Mobile’s unique value proposition of best network, best value, and best experiences, the Un-carrier is redefining connectivity and fueling competition while continuing to drive the next wave of innovation in wireless and beyond. Headquartered in Bellevue, Wash., T-Mobile provides services through its subsidiaries and operates its flagship brands, T-Mobile, Metro by T-Mobile, and Mint Mobile.

Loading…

NEWS

Arrow Systems Integration CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 12, 2025 05:08 AM

AEROSPACE REDEFINED | Collins Aerospace

A printed circuit board factory in Puerto Rico demonstrates digital technologies for the rest of RTX.

Read Article

August 31, 2025 07:00 AM

Asia is ahead of the curve of using AI to fight fraud. Here's what the rest of the world can learn from it

As Asia's crime syndicates make headlines, Asian banks are quietly leading a shift in how to prevent fraud.

Read Article

March 28, 2025 07:38 PM

Technology Advisory, Solutions & Managed Services

Accelerate modernization and maximize results through AI, data, cloud and app development, cybersecurity, technology consulting, platforms, and more.

Read Article

September 10, 2024 12:01 AM

KPMG recognized as a worldwide Leader in Systems Integrators for Cybersecurity Consulting Services

KPMG firms have been named a worldwide Leader in the IDC MarketScape: Worldwide Systems Integrators/Consultancies for Cybersecurity Consulting Services.

Read Article

June 24, 2024 08:50 PM

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

In the ever-evolving realm of cybersecurity, the increasing integration of Metaverse systems with cutting-edge technologies such as Artificial Intelligence...

Read Article

May 24, 2024 07:00 AM

How cybersecurity shapes supply chain resilience

Explore how the relationship between cybersecurity and supply chain risk management shapes ecosystem-wide resilience. A report developed in...

Read Article

November 01, 2023 07:00 AM

Governor Hochul Announces Updates To New York's Nation-Leading Cybersecurity Regulations As Part Of Sweeping Effort To Protect Businesses And Consumers From Cyber Threats

Governor Kathy Hochul today announced that the New York State Department of Financial Services has amended its nation-leading cybersecurity...

Read Article

August 07, 2022 10:54 AM

GLOBAL SYSTEMS INTEGRATORS

Access the industry's best technology, people and intelligence to defend against cyberthreats, meet compliance demands, secure your cloud journey and more.

Read Article

June 03, 2022 07:00 AM

AI and automation for cybersecurity

Security leaders are using AI for cybersecurity to boost visibility and productivity across security operations.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-77684

SUMMARY

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running. The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good. With the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled.

Published

Date2026-10-19

Updated

Date2026-10-19

RISK INFORMATION (Score: 5.7)

cvss3

Base Score: 5.7

Complexity: LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact Score

3.6

Exploitability

2.1

REFERENCES

CVE-2026-19595

SUMMARY

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread. An unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invoke the rtio_cqe_get_mempool_buffer() syscall with buff/buff_len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO_CQE_FLAG_MEMPOOL_BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG_USERSPACE together with CONFIG_RTIO_SYS_MEM_BLOCKS, the configuration behind RTIO_DEFINE_WITH_MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing. Two outcomes follow. If the target lies in a memory-domain partition declared K_MEM_PARTITION_P_RW_U_RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z_fatal_error() and the default k_sys_fatal_error_handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service. The read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE(), so a thread lacking write permission is terminated by K_OOPS before the implementation runs; the cqe argument correctly remains read-validated.

Published

Date2026-10-19

Updated

Date2026-10-19

RISK INFORMATION (Score: 6.1)

cvss3

Base Score: 6.1

Complexity: LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Impact Score

4.2

Exploitability

1.8

REFERENCES

CVE-2026-19178

SUMMARY

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

Published

Date2026-10-19

Updated

Date2026-10-19

RISK INFORMATION (Score: 6.8)

cvss3

Base Score: 6.8

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Impact Score

5.2

Exploitability

1.6

REFERENCES

https://www.ibm.com/support/pages/node/7292610

CVE-2026-112991

SUMMARY

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128). An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks. The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.

Published

Date2026-10-19

Updated

Date2026-10-19

RISK INFORMATION (Score: )

cvss4

Base Score: 6.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b

CVE-2026-112372

SUMMARY

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Published

Date2026-10-19

Updated

Date2026-10-19

RISK INFORMATION (Score: 6.6)

cvss2

Base Score: 5.8

Complexity: LOW

AV:N/AC:L/Au:M/C:P/I:P/A:P

cvss3

Base Score: 6.6

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

cvss4

Base Score: 2.0

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

3.7

Exploitability

2.3

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

Arrow Systems Integration Vendor Cyber Rating & Cyber Score

ASI A.I CyberSecurity Scoring

Arrow Systems Integration CyberSecurity News & History

ASI Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for ASI

Incidents vs Telecommunications Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types ASI vs Telecommunications Industry Avg (This Year)

Incident History - ASI (X = Date, Y = Severity)

Arrow Systems Integration Subsidiaries

ASI

Arrow Systems Integration Similar Companies

Telekom Malaysia

PT. Indosat Tbk

Bouygues Telecom

Telmex

Zain Group

TIM

ZTE Corporation

Cox Communications

T-Mobile

Arrow Systems Integration CyberSecurity News

AEROSPACE REDEFINED | Collins Aerospace

Asia is ahead of the curve of using AI to fight fraud. Here's what the rest of the world can learn from it

Technology Advisory, Solutions & Managed Services

KPMG recognized as a worldwide Leader in Systems Integrators for Cybersecurity Consulting Services

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

How cybersecurity shapes supply chain resilience

Governor Hochul Announces Updates To New York's Nation-Leading Cybersecurity Regulations As Part Of Sweeping Effort To Protect Businesses And Consumers From Cyber Threats

GLOBAL SYSTEMS INTEGRATORS

AI and automation for cybersecurity

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

Arrow Systems Integration CyberSecurity News & History

ASI Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for ASI

Incidents vs Telecommunications Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types ASI vs Telecommunications Industry Avg (This Year)

Incident History - ASI (X = Date, Y = Severity)

Arrow Systems Integration Subsidiaries

ASI

Arrow Systems Integration Similar Companies

Telekom Malaysia

PT. Indosat Tbk

Bouygues Telecom

Telmex

Zain Group

TIM

ZTE Corporation

Cox Communications

T-Mobile

Arrow Systems Integration CyberSecurity News

AEROSPACE REDEFINED | Collins Aerospace

Asia is ahead of the curve of using AI to fight fraud. Here's what the rest of the world can learn from it

Technology Advisory, Solutions & Managed Services

KPMG recognized as a worldwide Leader in Systems Integrators for Cybersecurity Consulting Services

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

How cybersecurity shapes supply chain resilience

Governor Hochul Announces Updates To New York's Nation-Leading Cybersecurity Regulations As Part Of Sweeping Effort To Protect Businesses And Consumers From Cyber Threats

GLOBAL SYSTEMS INTEGRATORS

AI and automation for cybersecurity

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo