PT-2026-6684 · Dcn · Dcn Dcme-320

Physicszq · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-2000

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DCN DCME-320 versions up to 20260121

Description A flaw exists in the Web Management Backend component of DCN DCME-320. Specifically, manipulating the ip list argument within the apply config function of the /function/system/basic/bridge cfg.php file can lead to command injection. This issue is remotely exploitable, and details about the exploit have been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 20260121: Avoid using the ip list parameter in the apply config function. Versions up to 20260121: As a temporary workaround, consider restricting access to the /function/system/basic/bridge cfg.php file.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-2000

Produtos afetados

Dcn Dcme-320

Referências · 8

• 🔥 https://github.com/physicszq/Routers/tree/main/Dcme · Exploit
• https://vuldb.com/?ctiid.344548 · Nota
• https://twitter.com/CVEnew/status/2019671075291123871 · Publicação no Twitter
• https://vuldb.com/?submit.743455 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2000 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-2000 · Aviso do Fabricante
• https://t.me/CVEtracker/43902 · Publicação no Telegram
• https://vuldb.com/?id.344548 · Nota