CVE-2026-23648
Published: 17 February 2026
Summary
CVE-2026-23648 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Glory Global (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-23648 is a local privilege escalation vulnerability in Glory RBG-100 recycler systems that use the ISPK-08 software component. The issue stems from multiple system binaries having overly permissive file permissions, where several binaries executed by the root user are writable and executable by unprivileged local users. This allows attackers with local access to replace or modify these binaries, as documented under CWE-732 (Incorrect Permission Assignment for Critical Resource). The vulnerability was published on 2026-02-17 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker requires local access with low-privilege user rights (PR:L) to exploit this vulnerability, facing low complexity (AC:L) and no user interaction. Successful exploitation enables the execution of arbitrary commands with root privileges, granting high-impact control over confidentiality, integrity, and availability on the affected system.
Mitigation details are available in vendor and advisory resources, including the Glory Global website at https://www.glory-global.com/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/glory-rbg-100-recycler-system-local-privilege-escalation-via-insecure-file-permissions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7910
Vulnerability details
Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries executed by the root user are writable and executable by unprivileged local users. An attacker with local access can replace…
more
or modify these binaries to execute arbitrary commands with root privileges, enabling local privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to File System Permissions Weakness (CWE-732) enabling binary replacement for local privilege escalation to root.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings, including restrictive file permissions on root-executed system binaries to prevent modification by unprivileged local users.
Limits access to make changes to critical system components, directly preventing unprivileged users from replacing or modifying root binaries.
Monitors the integrity of software and firmware to identify unauthorized modifications to vulnerable system binaries with overly permissive permissions.