CVE-2026-28517

Katalog CVE

CVSS 9.8 · Critical EPSS 9,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada opendcim. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

9,2% peluang dieksploitasi; lebih tinggi dari 95,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opendcim/openDCIM/pull/1664 issue tracking · patch
• https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 issue tracking · patch
• https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter advisory pihak ketiga
• https://github.com/Chocapikk/opendcim-exploit exploit
• https://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L467 product
• https://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L7 product