Vulnerability Spotlight: Code execution, information disclosure vulnerabilities in F2FS toolset

Summary: Cisco Talos researchers found five vulnerabilities in the F2FS toolset, a filesystem toolset common in embedded devices that creates, verifies and fixes Flash-Friendly File System files. The flaws, tracked as CVE-2020-6104 through CVE-2020-6108, include code execution and information disclosure issues in F2fs.Fsck 1.13 (and 1.12 for one case), triggered when an attacker supplies a malicious file, and Cisco disclosed them without an update after F2FS missed the 90-day deadline.
What you should know: These bugs sit in a filesystem checker that runs on embedded devices, and a single malicious file is enough to trigger code execution or leak sensitive information - with no vendor fix available at disclosure time.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-6104 CVE-2020-6105 CVE-2020-6106 CVE-2020-6107 CVE-2020-6108
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026