Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "cnMatrix EX3024F",
          "vendor": "Cambium",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in the Cambium\ncnMatrix EX3024F managed switch, firmware 6.2.1-r4.\n\nType: OS command injection (CWE-78, with CWE-20 bearing on it because\npercent-decoding is the only processing applied; CWE-250/CWE-269 bear on\nremediation priority). The COMMON_NAME form field submitted to\nPOST /iss/specific/ssl_digitalcert.html is extracted by HttpGetValuebyName,\npercent-decoded by issDecodeSpecialChar, copied with strncpy(buf, COMMON_NAME,\n100) and interpolated unfiltered into the double-quoted -subj \"%s\" argument of an\nopenssl req command string that the management daemon ISS.exe hands to system().\nFive functions stand between the HTTP parser and the sink and none validate the\ndata. A subject of \";id;echo \" closes the quote and injects a statement; the\ndaemon runs as root, so the injected command does too.\n\nScoring. This finding is dual-scored, with the deployment-conditional upper\nbound published alongside the verified baseline:\n- PRIMARY baseline, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. A\n  valid administrative session is required; the page is gated by a server-side\n  session table plus an administrator privilege check that is on by default.\n- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A\n  deployment-conditional upper bound where an installation retains a default,\n  weak or publicly known administrator password, a common condition for network\n  switches; the privilege prerequisite collapses in practice while the technical\n  chain is unchanged.\n\nThe advisory does not adopt the recorded vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nwith its paired 8.8, because the analysis documents an administrator-only check\nrather than any-low-privilege-user access, so PR:H (7.2) is the faithful metric.\nA 9.1 scope-changed reading is also rejected: the compromised OS and the daemon\nsit inside one authorization domain, the daemon being already root over that OS.\n\nImpact: root command execution on a managed switch, a forwarding-plane device\nrather than only a management plane: full compromise of configuration and keys,\ninstallation of a persistent backdoor that survives reboot, a pivot into adjacent\nsegments, and live manipulation or denial of the traffic it carries.\n\nAuthentication: post-authentication administrator.\n\nVerification boundary, stated plainly. Confirmation used an extracted firmware\nimage under qemu-aarch64-static user-mode emulation. Because the daemon cannot\ncomplete initialisation without the Marvell switch ASIC driver and never binds an\nHTTP port in emulation, the real shipped sink function (SslGenCertRequest) was\ninvoked directly under debugger control with the payload an HTTP POST would\ndeliver; it returned 0 and wrote a 36-byte root-owned marker containing\nuid=0(root) gid=0(root). End-to-end HTTP exploitation against a device was NOT\nperformed and no physical hardware was used. The five-handler HTTP-to-sink path\nis proven statically by decompilation and cross-reference, not by an observed\nnetwork request. Any model or firmware revision beyond EX3024F 6.2.1-r4 is\ninference and unconfirmed.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-269",
              "description": "CWE-269",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/70"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/70"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/70"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0424",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/70",
            "automated": true,
            "contentSha256": "1432ddd5efb94e1fd31e8f24bdf9084ce610345f06a6ed2de63e30ff2060564d",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/70",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:53:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0424"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}