Skip to content

Batch 8

Latest
Latest

Choose a tag to compare

View all tags
@Exploit-Garbage Exploit-Garbage released this 25 Aug 15:09
· 1 commit to main since this release
batch-8-2026-08
00171cd

Batch #8 — August 2026

10 advisories · 10 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Eighth batch — expanding coverage into industrial analytics, SCADA, meeting-room AV, VDI brokering, data-center power management, telephony, industrial energy management, UTM gateways, and self-hosted web applications. Headline: Seeq Server unauthenticated RCE via open self-registration plus Data Lab Jupyter missing authorization, and mySCADA PRO Runtime unauthenticated root RCE via the /s.fcgi upgrade branch. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

# Product Affected Version CVSS Class Advisory & PoC
1 Seeq Server R65.2.3 9.8 Unauth self-registration + Data Lab Jupyter missing-auth RCE Jupyter kernel → RCE
2 mySCADA PRO Runtime 9.4.0 9.4 Unauth upgrade Cmd Injection → Root /s.fcgi upgrade → Root RCE
3 Biamp Devio SCR-20/25 2.3.1 9.8 Unauth DTP Protocol Quote Injection → Root DTP password sink → Root RCE
4 Leostream Broker (VULN-002) 9.1.37.0 7.0 Unauth Rogue-Agent Registration + SSRF Server.Register → SSRF
5 Raritan EMX emx_ecx_3.6.1 8.8 Auth Config Injection → port_mux Root proto_listener → Root RCE
6 Leostream Broker (VULN-001) 9.1.37.0 9.1 Auth SQLi → lo_export Webshell → Root _where SQLi → Root RCE
7 VitalPBX 4.5.2 8.8 Auth asterisk_cli → Dialplan System() Root CLI → System() → Root RCE
8 Delta DIAEnergie IEMS V1.11 8.8 Auth CommandTag SQLi → VBScript RCE tid SQLi → VBScript RCE
9 CacheGuard UF-2.5.2 8.8 Auth Config-Import Eval Injection RCE conf inject eval → RCE
10 Maian Gallery 2.1 7.2 Auth Admin Unrestricted Upload → Root upload_thumbnail → RCE

Highlights

  • 4 critical (CVSS ≥ 9.0) · 4 unauthenticated · 6 authenticated (deep-chain)
  • Headline: Seeq Server — factory-default open self-registration (CWE-306) plus Data Lab Jupyter missing administrator authorization (CWE-862) → arbitrary Python execution as the datalab user (uid 9500); mySCADA PRO Runtime — unauthenticated /s.fcgi upgrade-branch command injection executing as root in the default container.
  • Other unauth entries: Biamp Devio DTP protocol single-quote breakout to root; Leostream Server.Register rogue-agent registration + outbound TLS SSRF.
  • Authenticated deep-chain entries: Raritan EMX config injection into the root port_mux daemon; Leostream SQLi → lo_export webshell → sudo root; VitalPBX Asterisk CLI → dialplan System() root; Delta DIAEnergie IEMS SQLi → VBScript execution; CacheGuard config-import eval injection; Maian Gallery admin unrestricted upload → PHP webshell.
  • Attack classes: missing authentication, missing authorization, command injection, SQL injection, configuration/eval injection, unrestricted upload, server-side request forgery, privilege escalation.

Totals

10 advisories · 10 vendors · 4 unauthenticated · 6 authenticated (deep-chain) · 7 system-level (root/SYSTEM) · all with reproducible PoC.

Cumulative across 8 batches: 78 advisories.

Assets 2
Loading