VDE-2026-127

Vulnerability from csaf_welotecgmbh - Published: 2026-10-29 10:00 - Updated: 2026-10-29 10:00
Summary
Welotec: PHP2Shell Vulnerabilities in SMART EMS
Severity
Critical
Notes
Summary: Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.
Impact: Successful exploitation may allow an unauthenticated remote attacker with access to the SMART EMS Web UI to execute arbitrary code with the permissions of the PHP web worker and application container. The attacker may access or modify application data and credentials, alter application behaviour, establish persistence within the affected container, or disrupt the availability of SMART EMS.
Mitigation: Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Monitor affected systems for unexpected processes, file changes, authentication activity, and outbound network connections. Where operationally possible, disable PHP session upload progress by setting `session.upload_progress.enabled=0` and restart all PHP workers. On PHP 8.5, additionally set `fatal_error_backtraces=0`. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. Do not apply this measure globally where SMART EMS upload functions are required. These measures reduce exposure to confirmed attack paths but are not complete mitigations. Where exposure cannot be reduced and operational requirements permit, consider taking the affected service offline until a updated SMART EMS release is installed.
Remediation: Update SMART EMS to version 3.5.4 or later.
CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
SMART EMS Web Application v3.5.4
Welotec / Software / SMART EMS Web Application
 cpe:2.3:a:welotec:smart_ems:3.5.4:*:*:*:*:*:*:* 3.5.4
Product Identifier Version Remediation
SMART EMS Web Application <3.5.4
Welotec / Software / SMART EMS Web Application
 alpha cpe:2.3:a:welotec:smart_ems:*:*:*:*:*:*:*:* vers:semver/>=0.0.0|<3.5.4
Mitigation
Vendor Fix
CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 1 product, the same list as for CVE-2026-109618
Known affected 1 product, the same list as for CVE-2026-109618
References
Acknowledgments
CERT@VDE certvde.com
lcfr-hax sagitzadik-wiz tomash-areion amyb-oai
PHP Security Team
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "lcfr-hax",
          "sagitzadik-wiz",
          "tomash-areion",
          "amyb-oai"
        ],
        "summary": "reporting"
      },
      {
        "organization": "PHP Security Team",
        "summary": "remediation"
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.",
        "title": "Summary"
      },
      {
        "category": "details",
        "text": "Successful exploitation may allow an unauthenticated remote attacker with access to the SMART EMS Web UI to execute arbitrary code with the permissions of the PHP web worker and application container. The attacker may access or modify application data and credentials, alter application behaviour, establish persistence within the affected container, or disrupt the availability of SMART EMS.",
        "title": "Impact"
      },
      {
        "category": "details",
        "text": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Monitor affected systems for unexpected processes, file changes, authentication activity, and outbound network connections.\n\nWhere operationally possible, disable PHP session upload progress by setting `session.upload_progress.enabled=0` and restart all PHP workers. On PHP 8.5, additionally set `fatal_error_backtraces=0`. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. Do not apply this measure globally where SMART EMS upload functions are required. These measures reduce exposure to confirmed attack paths but are not complete mitigations.\n\nWhere exposure cannot be reduced and operational requirements permit, consider taking the affected service offline until a updated SMART EMS release is installed.",
        "title": "Mitigation"
      },
      {
        "category": "details",
        "text": "Update SMART EMS to version 3.5.4 or later.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@welotec.com",
      "name": "Welotec GmbH",
      "namespace": "https://welotec.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Welotec PSIRT",
        "url": "https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Welotec",
        "url": "https://certvde.com/de/advisories/vendor/welotec"
      },
      {
        "category": "self",
        "summary": "VDE-2026-127: Welotec: PHP2Shell Vulnerabilities in SMART EMS - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-127"
      },
      {
        "category": "self",
        "summary": "VDE-2026-127: Welotec: PHP2Shell Vulnerabilities in SMART EMS - CSAF",
        "url": "https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-127.json"
      }
    ],
    "title": "Welotec: PHP2Shell Vulnerabilities in SMART EMS",
    "tracking": {
      "aliases": [
        "VDE-2026-127"
      ],
      "current_release_date": "2026-10-29T10:00:00.000Z",
      "generator": {
        "date": "2026-10-29T10:45:21.070Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-127",
      "initial_release_date": "2026-10-29T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-29T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/\u003e=0.0.0|\u003c3.5.4",
                    "product": {
                      "name": "SMART EMS Web Application \u003c3.5.4",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:welotec:smart_ems:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "alpha"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.4",
                    "product": {
                      "name": "SMART EMS Web Application v3.5.4",
                      "product_id": "CSAFPID-52001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:welotec:smart_ems:3.5.4:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "SMART EMS Web Application"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Welotec"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE description"
        },
        {
          "category": "details",
          "text": "Associated weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Improperly Controlled Sequential Memory Allocation), and CWE-1419 (Incorrect Initialization of Resource). CSAF 2.0 permits one primary CWE per vulnerability; CWE-416 is used in the structured CWE field.",
          "title": "Weaknesses"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. These measures reduce exposure to confirmed attack paths but are not a complete mitigation.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update SMART EMS to version 3.5.4 or later.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "RCE via OOM corruption"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE description"
        },
        {
          "category": "details",
          "text": "Associated weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Improperly Controlled Sequential Memory Allocation), and CWE-1419 (Incorrect Initialization of Resource). CSAF 2.0 permits one primary CWE per vulnerability; CWE-416 is used in the structured CWE field.",
          "title": "Weaknesses"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, disable PHP session upload progress by setting `session.upload_progress.enabled=0` and restart all PHP workers. On PHP 8.5, additionally set `fatal_error_backtraces=0`. These settings reduce exposure to confirmed attack paths but are not a complete mitigation.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update SMART EMS to version 3.5.4 or later.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "RCE via stale global state"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.