Critical Remote Code Execution Vulnerability Disclosed on U.S. Election Assistance Commission Website

On October 29, cybersecurity firm XBOW disclosed that it discovered an unauthenticated critical remote code execution vulnerability in a public web application operated by the U.S. Election Assistance Commission (EAC). The application is used for resource and logistics calculations and is not a voting machine or voter registration system. The vulnerability could allow an attacker to execute code with root privileges in backend containers and access local protected resources and external networks by crafting specific web requests. XBOW stated that it reported the issue in accordance with the vulnerability disclosure policy published by the EAC, and after verification by the EAC team, the vulnerability was patched prior to the upcoming U.S. federal midterm elections.