PT-2026-50878 · Sima Gmbh · Bondix Server

Jonas Friedli · Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-12104

Mitre

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-12104

Produtos afetados

Bondix Server

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12104 · Nota de Segurança
• https://wiki.bondix.dev/wiki/Security_Advisories#CVE-2026-12104_%E2%80%94_Authenticated_OS_Command_Injection_in_Bondix · Nota
• https://wiki.bondix.dev/wiki/Downloads#Release_Notes · Nota