XBOW reports unauthenticated critical RCE in EAC web application
XBOW says it identified a critical, unauthenticated remote code execution (RCE) flaw in a public web application of the U.S. Election Assistance Commission (EAC). Per XBOW, the application was a resource and logistics calculator, unrelated to voting machines or voter registration. Sources give no CVE, fix, or signs of exploitation; EAC confirmation is pending.
What happened
Security firm XBOW says it identified a critical remote code execution flaw requiring no authentication in a public web application of the U.S. Election Assistance Commission (EAC), the U.S. federal commission focused on election administration. Per XBOW, the affected application was a resource and logistics calculator. The EAC has not confirmed the case in the sources.
Why it matters
If confirmed, the flaw would allow code execution on the application server without any login, per XBOW's description. Per XBOW, the affected system was a calculator, unrelated to voting machines or voter registration. Sources show no fix and no signs of exploitation.
What to do
Watch official EAC and XBOW channels for confirmation, CVE, and a patch. If your company runs public web tools without login, review them for remote code execution.
For the technical team
- Affected
- U.S. Election Assistance Commission (EAC) Aplicação web pública da Election Assistance Commission; calculadora de recursos e logística, sem relação com urnas eletrônicas ou registro de eleitores · Public web application of the U.S. Election Assistance Commission, described by XBOW as a resource/logistics calculator. Versions not stated. Per XBOW, it does not involve voting machines or voter registration systems.
- Exploitation
- No exploitation reported in the sources. No CVE, no KEV entry, and no PoC mentioned.
- Fix
- Not stated in the sources. The EAC must confirm the flaw and patch the application.
- Vector
- Public web application of the EAC, exposed to the internet. Unauthenticated, critical-severity remote code execution (RCE) flaw, according to XBOW. Specific component and other exploitation conditions were not disclosed.
- More details
- Discovery credited to XBOW and disclosed in a thread on X. The EAC is described as an independent, bipartisan federal commission focused on election administration. XBOW clarified that the vulnerable application was a resource/logistics calculator.
Timeline
XBOW clarifies that the vulnerable application was a resource/logistics calculator, not a voting machine or voter registration system.
XBOW research, shared in an X thread, details the flaw found in the EAC application.
