The website of the U.S. Election Assistance Commission has been disclosed to have a serious remote code execution vulnerability

Cybersecurity company XBOW published a statement disclosing a critical remote code execution vulnerability that can be exploited without authentication in a public web application of the U.S. Election Assistance Commission (EAC). This application is used for resource and logistics calculations, not for voting machines or voter registration systems.

The vulnerability could allow attackers to execute code with root privileges in the backend container by crafting specific web requests, and access local protected resources and external networks. XBOW stated that it reported the issue according to the vulnerability disclosure policy published by the EAC, and after verification by the EAC team, the vulnerability was fixed before the U.S. federal midterm elections.