CVE-2026-8666: Insightconnect Traceroute: işletim sistemi komut enjeksiyonu

Açıklama (NVD)

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

Özet bilgiler

Ürün

Rapid7 Insightconnect Traceroute

CVSS v3.1

9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

%1,20 (yüzdelik 68)

CWE

CWE-78

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• extensions.rapid7.com
• CWE-78