[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-06 17:44 UTC
Importiert: 2026-10-15 08:09 UTC
Quelle-ID: full_disc
uid_hash: 4746597b3860ffe43e275d039ed125329c3cdb459dbd09545a0674d18a4edb70

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebADM

2.4.14, Freeware Edition, the closed-source IAM/MFA management platform from RCDevs

Security SA (Luxembourg) that fronts the vendor's OpenOTP, SpanKey and TiQR

authentication products.

Type: OS command injection (CWE-78, with CWE-20 and CWE-116 contributing, and

CWE-732/CWE-276 and CWE-250 added for two auxiliary conditions). The administrator

console log...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss