Executive brief
Internet Storage Name Service (iSNS) is a protocol used to discover and manage storage devices on networks. A numeric truncation error allows an authorized user to read sensitive information from the service that they should not have access to, potentially exposing configuration details or other confidential data.
Technical details
A numeric truncation error exists in Internet Storage Name Service implementations, allowing an authenticated attacker to bypass access controls and disclose sensitive local information. The vulnerability requires prior authentication or authorization to the iSNS service and does not require network exploitation. An attacker with valid credentials can leverage the truncation error to read data beyond their intended access permissions. The exact patch status is not fully detailed in available references, but the CVE record indicates this is a known issue requiring a security update.
Affected products
- Internet Storage Name Service
Timeline
- 2026-09-08: disclosed