Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Qingteng

    CVE-2026-105044 (GCVE-0-2026-105044)

    Vulnerability from nvd – Published: 2026-10-21 01:02 – Updated: 2026-10-21 01:02
    VLAI
    Title
    OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
    Summary
    Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection
    Severity
    8.5 (High)
    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    Mandiant CNA under the Google root
    CNA scorecard B 80/100 over 14 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Qingteng Host Adaptive Security Platform Affected: 0 , < 20260929 (date)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Security Toolbox",
          "product": "Host Adaptive Security Platform",
          "vendor": "Qingteng",
          "versions": [
            {
              "lessThan": "20260929",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cspan\u003eImproper Neutralization of Special Elements used in an OS Command in\u0026nbsp;Security Toolbox versions before\u0026nbsp;20260929 in\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQingteng Host Adaptive Security Platfor\u003c/span\u003e\u003cspan\u003em (Host Monitoring) V3.0 allows a\u003c/span\u003e\u003cspan\u003en authenticated console administrator to execute arbitrary commands on attached clients via OS command injection\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an OS Command in\u00a0Security Toolbox versions before\u00a020260929 in\u00a0Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T01:02:23.730Z",
        "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "shortName": "Mandiant"
      },
      "references": [
        {
          "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0038.md"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
    "assignerShortName": "Mandiant",
    "cveId": "CVE-2026-105044",
    "datePublished": "2026-10-21T01:02:23.730Z",
    "dateReserved": "2026-10-02T21:36:13.254Z",
    "dateUpdated": "2026-10-21T01:02:23.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-105044 (GCVE-0-2026-105044)

    Vulnerability from cvelistv5 – Published: 2026-10-21 01:02 – Updated: 2026-10-21 01:02
    VLAI
    Title
    OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
    Summary
    Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection
    Severity
    8.5 (High)
    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    Mandiant CNA under the Google root
    CNA scorecard B 80/100 over 14 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Qingteng Host Adaptive Security Platform Affected: 0 , < 20260929 (date)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Security Toolbox",
          "product": "Host Adaptive Security Platform",
          "vendor": "Qingteng",
          "versions": [
            {
              "lessThan": "20260929",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cspan\u003eImproper Neutralization of Special Elements used in an OS Command in\u0026nbsp;Security Toolbox versions before\u0026nbsp;20260929 in\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQingteng Host Adaptive Security Platfor\u003c/span\u003e\u003cspan\u003em (Host Monitoring) V3.0 allows a\u003c/span\u003e\u003cspan\u003en authenticated console administrator to execute arbitrary commands on attached clients via OS command injection\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an OS Command in\u00a0Security Toolbox versions before\u00a020260929 in\u00a0Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T01:02:23.730Z",
        "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "shortName": "Mandiant"
      },
      "references": [
        {
          "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0038.md"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
    "assignerShortName": "Mandiant",
    "cveId": "CVE-2026-105044",
    "datePublished": "2026-10-21T01:02:23.730Z",
    "dateReserved": "2026-10-02T21:36:13.254Z",
    "dateUpdated": "2026-10-21T01:02:23.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}