Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-08-18 06:17 UTC
  • Importiert: 2026-08-20 07:43 UTC
  • Quelle-ID: full_disc
  • uid_hash: 14f9969c2423067082ef27779fff4b08ab189ef1387164d23ddb14adc3b8cd3b
Full Disclosure

Inhalt

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI

Software). The research is published and a proof-of-concept is available.

Authenticated RCE (command injection) (CVSS 8.8, authenticated)

Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method

Server.startEncryption. The password parameter is double-quoted and concatenated...

No data

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Full Disclosure

full_disc

 threat_intel - de https://seclists.org/rss/fulldisclosure.rss
Zurueck zur Eintrags-Liste