Allegro vulnerabilities
6 vulnerabilities
Known vulnerabilities in Allegro products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5CVE-2026-111683allegroralph
EPSS score0.24%
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.CVE-2021-42110allegroallegroEPSS score0.30%
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking.CVE-2021-43978allegroallegroEPSS score0.77%
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.CVE-2000-0470allegrorom_pagerEPSS score7.12%
Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a malformed authentication request.CVE-2024-0522allegrorompager+1EPSS score0.24%
A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 4.30 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250692. NOTE: The vendor explains that this is a very old issue that got fixed 20 years ago but without a public disclosure.CVE-2023-25392allegrobigflow+1EPSS score0.43%
Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.