GCVE-1988-2026-0468

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0. Type: OS command injection (CWE-78, with CWE-20 bearing on it because no character validation exists anywhere on the path; CWE-250 bears on the result). The server property package.dnf.repo.gpg_key, the URL or path of the GPG key signing the vendor RPM repository, is written through the authenticated management REST API and persisted to the server properties file untouched. On service start or restart the package-management thread formats it into the unquoted command template rpm --import {} and hands the result to popen, that is to a shell. Every shell metacharacter in the value, separators, pipes, backticks, command substitutions and redirections, is interpreted as command syntax. The shipped service unit carries no user directive, so the injected command runs as uid 0. The injection fires during thread initialization and repeats on every subsequent boot until the property is corrected. Scoring. Dual-scored, with the primary reading named first: - PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The write endpoint requires the config permission, which the vendor's own shipped OpenAPI role table grants in base scope to exactly one role, Administrator, so the privilege prerequisite is administrative. - CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, for installations that still accept the administrator credential the vendor's own installer declares as the packaged default; on such a deployment no privilege has to be obtained at all. This is the deployment-conditional reading, not the headline. The advisory also discloses, and deliberately does not adopt, an intermediate 8.8 reading carried by our own earlier research record paired with a low-privilege metric: the arithmetic is correct for that vector but that privilege level contradicts the shipped role table. A scope-changed reading is rejected and not claimed. Impact: arbitrary command execution as uid 0 on a video management server with one authenticated request plus the restart that request itself causes; read and rewrite of the recorded video archive, that is of physical-security evidence; persistence through the service unit or loaded libraries; and lateral reach from a host that by design spans camera networks. This is a post-authentication finding: the unauthenticated surface was exhausted, with nearly every specified path requiring authentication, the few unauthenticated endpoints parameterless and read-only, and traversal and bypass attempts all rejected. Debian-family deployments take the APT branch and never reach this sink; RHEL-family deployments are affected. Verification boundary, stated plainly. A real installation of the vendor's Debian bundle inside a Linux container, driven purely through the documented HTTP API with the installer-default credential; three independent root-owned marker artifacts were produced and command substitution was demonstrably evaluated on the target. One departure from stock is declared: the DNF code path was entered by presenting the Debian-family container as RHEL-family and supplying the repository directory and template files the code requires, which a native RHEL-family host provides by itself. No native RHEL host was exploited, no container escape was attempted or claimed, and only the 26.3.0 bundle was installed and executed. Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish The vendor has been notified through the corporate contact address published on its own site, as no security-specific intake is published. No vulnerability identifier has been assigned to this finding yet. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 576 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Ipconfigure Orchid VMS Affected: unknown
guessed Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Orchid VMS",
          "vendor": "Ipconfigure",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nIPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0.\n\nType: OS command injection (CWE-78, with CWE-20 bearing on it because no\ncharacter validation exists anywhere on the path; CWE-250 bears on the\nresult). The server property package.dnf.repo.gpg_key, the URL or path of\nthe GPG key signing the vendor RPM repository, is written through the\nauthenticated management REST API and persisted to the server properties\nfile untouched. On service start or restart the package-management thread\nformats it into the unquoted command template rpm --import {} and hands the\nresult to popen, that is to a shell. Every shell metacharacter in the value,\nseparators, pipes, backticks, command substitutions and redirections, is\ninterpreted as command syntax. The shipped service unit carries no user\ndirective, so the injected command runs as uid 0. The injection fires during\nthread initialization and repeats on every subsequent boot until the\nproperty is corrected.\n\nScoring. Dual-scored, with the primary reading named first:\n- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The write\n  endpoint requires the config permission, which the vendor\u0027s own shipped\n  OpenAPI role table grants in base scope to exactly one role,\n  Administrator, so the privilege prerequisite is administrative.\n- CONDITIONAL, 9.8 Critical,\n  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, for installations that still\n  accept the administrator credential the vendor\u0027s own installer declares as\n  the packaged default; on such a deployment no privilege has to be obtained\n  at all. This is the deployment-conditional reading, not the headline.\nThe advisory also discloses, and deliberately does not adopt, an\nintermediate 8.8 reading carried by our own earlier research record paired\nwith a low-privilege metric: the arithmetic is correct for that vector but\nthat privilege level contradicts the shipped role table. A scope-changed\nreading is rejected and not claimed.\n\nImpact: arbitrary command execution as uid 0 on a video management server\nwith one authenticated request plus the restart that request itself causes;\nread and rewrite of the recorded video archive, that is of physical-security\nevidence; persistence through the service unit or loaded libraries; and\nlateral reach from a host that by design spans camera networks. This is a\npost-authentication finding: the unauthenticated surface was exhausted, with\nnearly every specified path requiring authentication, the few unauthenticated\nendpoints parameterless and read-only, and traversal and bypass attempts all\nrejected. Debian-family deployments take the APT branch and never reach this\nsink; RHEL-family deployments are affected.\n\nVerification boundary, stated plainly. A real installation of the vendor\u0027s\nDebian bundle inside a Linux container, driven purely through the documented\nHTTP API with the installer-default credential; three independent root-owned\nmarker artifacts were produced and command substitution was demonstrably\nevaluated on the target. One departure from stock is declared: the DNF code\npath was entered by presenting the Debian-family container as RHEL-family and\nsupplying the repository directory and template files the code requires,\nwhich a native RHEL-family host provides by itself. No native RHEL host was\nexploited, no container escape was attempted or claimed, and only the 26.3.0\nbundle was installed and executed.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through the corporate contact address published\non its own site, as no security-specific intake is published. No\nvulnerability identifier has been assigned to this finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/5"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ipconfigure-orchid-vms-dnf-gpg-key-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0468",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/5",
            "automated": true,
            "contentSha256": "44b60680028e167ff87f3e91e608c2cbef11dd13e4a45f3f0911a0a2e4e1e365",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-05T17:53:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:01Z",
    "dateUpdated": "2026-11-02T07:30:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0468"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.