SB20260414101 - OS Command Injection in openITCOCKPIT

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260414101

SB20260414101 - OS Command Injection in openITCOCKPIT

Published: April 14, 2026

Security Bulletin ID SB20260414101
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: CVE-2026-24893)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to command injection in host configuration monitoring command generation when expanding user-supplied host address macros into shell-executed monitoring command templates. A remote user can submit a crafted host address to execute arbitrary code.

Exploitation requires permission to add or modify hosts, and both master and satellite monitoring setups are affected.


Remediation

Install update from vendor's website.

References