{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The \nresearch is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server \nmint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings \nmethod gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM \nsystem properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The \nfactory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger. \nDynamic verification produced uid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no \nproduct license key and no user credentials.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce\n\nVulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)\n\nThe factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password \nverification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path, \nwhere simpleMD5Hash(\u0027\u0027) returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can \nauthenticate as the administrator using admin with an empty password, as long as the factory default has not been \nchanged. This grants full administrator control of the MAM server and is the credential prerequisite for the \nauthenticated root RCE chain.\n\nImpact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty \npassword; the admin session can read or alter any catalog data, server configuration, or user account.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password\n\nVulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)\n\nAn authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM \nsystem property to point at an attacker-controlled script and then triggering an AAF export. The type-23 \n\u0027server-config\u0027 setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and \nAAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is \nauto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced \nuid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the \nweb API is required.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0054",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6",
            "automated": true,
            "contentSha256": "fcc939a21fe54550bf830f81863d367df0c4c732c3286455b68ac1bbeac4087b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0054"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}