Search
Find a vulnerability
Search criteria
3 vulnerabilities by ipconfigure
GCVE-1988-2026-0468
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in
IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0.
Type: OS command injection (CWE-78, with CWE-20 bearing on it because no
character validation exists anywhere on the path; CWE-250 bears on the
result). The server property package.dnf.repo.gpg_key, the URL or path of
the GPG key signing the vendor RPM repository, is written through the
authenticated management REST API and persisted to the server properties
file untouched. On service start or restart the package-management thread
formats it into the unquoted command template rpm --import {} and hands the
result to popen, that is to a shell. Every shell metacharacter in the value,
separators, pipes, backticks, command substitutions and redirections, is
interpreted as command syntax. The shipped service unit carries no user
directive, so the injected command runs as uid 0. The injection fires during
thread initialization and repeats on every subsequent boot until the
property is corrected.
Scoring. Dual-scored, with the primary reading named first:
- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The write
endpoint requires the config permission, which the vendor's own shipped
OpenAPI role table grants in base scope to exactly one role,
Administrator, so the privilege prerequisite is administrative.
- CONDITIONAL, 9.8 Critical,
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, for installations that still
accept the administrator credential the vendor's own installer declares as
the packaged default; on such a deployment no privilege has to be obtained
at all. This is the deployment-conditional reading, not the headline.
The advisory also discloses, and deliberately does not adopt, an
intermediate 8.8 reading carried by our own earlier research record paired
with a low-privilege metric: the arithmetic is correct for that vector but
that privilege level contradicts the shipped role table. A scope-changed
reading is rejected and not claimed.
Impact: arbitrary command execution as uid 0 on a video management server
with one authenticated request plus the restart that request itself causes;
read and rewrite of the recorded video archive, that is of physical-security
evidence; persistence through the service unit or loaded libraries; and
lateral reach from a host that by design spans camera networks. This is a
post-authentication finding: the unauthenticated surface was exhausted, with
nearly every specified path requiring authentication, the few unauthenticated
endpoints parameterless and read-only, and traversal and bypass attempts all
rejected. Debian-family deployments take the APT branch and never reach this
sink; RHEL-family deployments are affected.
Verification boundary, stated plainly. A real installation of the vendor's
Debian bundle inside a Linux container, driven purely through the documented
HTTP API with the installer-default credential; three independent root-owned
marker artifacts were produced and command substitution was demonstrably
evaluated on the target. One departure from stock is declared: the DNF code
path was entered by presenting the Debian-family container as RHEL-family and
supplying the repository directory and template files the code requires,
which a native RHEL-family host provides by itself. No native RHEL host was
exploited, no container escape was attempted or claimed, and only the 26.3.0
bundle was installed and executed.
Full technical analysis and a reproducible proof-of-concept:
https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
The vendor has been notified through the corporate contact address published
on its own site, as no security-specific intake is published. No
vulnerability identifier has been assigned to this finding yet.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ipconfigure | Orchid VMS |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Orchid VMS",
"vendor": "Ipconfigure",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nIPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0.\n\nType: OS command injection (CWE-78, with CWE-20 bearing on it because no\ncharacter validation exists anywhere on the path; CWE-250 bears on the\nresult). The server property package.dnf.repo.gpg_key, the URL or path of\nthe GPG key signing the vendor RPM repository, is written through the\nauthenticated management REST API and persisted to the server properties\nfile untouched. On service start or restart the package-management thread\nformats it into the unquoted command template rpm --import {} and hands the\nresult to popen, that is to a shell. Every shell metacharacter in the value,\nseparators, pipes, backticks, command substitutions and redirections, is\ninterpreted as command syntax. The shipped service unit carries no user\ndirective, so the injected command runs as uid 0. The injection fires during\nthread initialization and repeats on every subsequent boot until the\nproperty is corrected.\n\nScoring. Dual-scored, with the primary reading named first:\n- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The write\n endpoint requires the config permission, which the vendor\u0027s own shipped\n OpenAPI role table grants in base scope to exactly one role,\n Administrator, so the privilege prerequisite is administrative.\n- CONDITIONAL, 9.8 Critical,\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, for installations that still\n accept the administrator credential the vendor\u0027s own installer declares as\n the packaged default; on such a deployment no privilege has to be obtained\n at all. This is the deployment-conditional reading, not the headline.\nThe advisory also discloses, and deliberately does not adopt, an\nintermediate 8.8 reading carried by our own earlier research record paired\nwith a low-privilege metric: the arithmetic is correct for that vector but\nthat privilege level contradicts the shipped role table. A scope-changed\nreading is rejected and not claimed.\n\nImpact: arbitrary command execution as uid 0 on a video management server\nwith one authenticated request plus the restart that request itself causes;\nread and rewrite of the recorded video archive, that is of physical-security\nevidence; persistence through the service unit or loaded libraries; and\nlateral reach from a host that by design spans camera networks. This is a\npost-authentication finding: the unauthenticated surface was exhausted, with\nnearly every specified path requiring authentication, the few unauthenticated\nendpoints parameterless and read-only, and traversal and bypass attempts all\nrejected. Debian-family deployments take the APT branch and never reach this\nsink; RHEL-family deployments are affected.\n\nVerification boundary, stated plainly. A real installation of the vendor\u0027s\nDebian bundle inside a Linux container, driven purely through the documented\nHTTP API with the installer-default credential; three independent root-owned\nmarker artifacts were produced and command substitution was demonstrably\nevaluated on the target. One departure from stock is declared: the DNF code\npath was entered by presenting the Debian-family container as RHEL-family and\nsupplying the repository directory and template files the code requires,\nwhich a native RHEL-family host provides by itself. No native RHEL host was\nexploited, no container escape was attempted or claimed, and only the 26.3.0\nbundle was installed and executed.\n\nFull technical analysis and a reproducible proof-of-concept:\n https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through the corporate contact address published\non its own site, as no security-specific intake is published. No\nvulnerability identifier has been assigned to this finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/5"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/5"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/5"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0468",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/5",
"automated": true,
"contentSha256": "44b60680028e167ff87f3e91e608c2cbef11dd13e4a45f3f0911a0a2e4e1e365",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/5",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-05T17:53:12Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:01Z",
"dateUpdated": "2026-11-02T07:30:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0468"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-10956 (GCVE-0-2018-10956)
Vulnerability from nvd – Published: 2018-06-25 15:00 – Updated: 2024-08-05 07:54
VLAI
EPSS
VEX
Summary
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/148274/IPCon… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/44916/ | exploitx_refsource_EXPLOIT-DB |
Date Public
2018-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:35.968Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44916/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-25T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44916/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10956",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44916/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10956",
"datePublished": "2018-06-25T15:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:35.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10956 (GCVE-0-2018-10956)
Vulnerability from cvelistv5 – Published: 2018-06-25 15:00 – Updated: 2024-08-05 07:54
VLAI
EPSS
VEX
Summary
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/148274/IPCon… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/44916/ | exploitx_refsource_EXPLOIT-DB |
Date Public
2018-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:35.968Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44916/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-25T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44916/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10956",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/148274/IPConfigure-Orchid-VMS-2.0.5-Directory-Traversal-Information-Disclosure.html"
},
{
"name": "44916",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44916/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10956",
"datePublished": "2018-06-25T15:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:35.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}