Aruba Sign up to 4.6.5 File default permission

Summaryinfo

A vulnerability labeled as critical has been found in Aruba Sign up to 4.6.5. The impacted element is an unknown function of the component File Handler. Executing a manipulation can lead to default permission. This vulnerability is handled as CVE-2026-12602. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Aruba Sign up to 4.6.5 and classified as critical. This vulnerability affects an unknown part of the component File Handler. The manipulation with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In the worst-case scenario, if the malicious code is executed with elevated privileges (such as those of Administrator or SYSTEM), the attacker could escalate privileges and gain full control of the system, compromising both security and data integrity.

The weakness was released by Andrea Intilangelo. The advisory is shared for download at incibe.es. This vulnerability was named CVE-2026-12602 since 06/18/2026. The exploitation appears to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/22/2026). The MITRE ATT&CK project declares the attack technique as T1222.

Upgrading to version 4.6.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Aruba

Name

• Sign

Version

• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4
• 4.6.5

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion