PT-2026-20559 · Unknown · Seccn Dingcheng G10

Ruler-Chovy · Published 2026-02-19 · Updated 2026-02-24 · CVE-2026-2686

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SECCN Dingcheng G10 version 3.1.0.181203

Description A security issue has been identified in SECCN Dingcheng G10 version 3.1.0.181203. The qq function within the /cgi-bin/session login.cgi file is susceptible to operating system command injection. Manipulation of the User parameter can lead to remote execution of arbitrary commands. The exploit for this issue has been publicly disclosed. The attack can be carried out remotely.

Recommendations Versions prior to 3.1.0.181203 are affected. As a temporary workaround, consider restricting access to the /cgi-bin/session login.cgi file until a fix is available. Avoid using the User parameter in the /cgi-bin/session login.cgi endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-2686

Affected Products

Seccn Dingcheng G10

References · 11

• 🔥 https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md#2-vulnerability-reproduction-proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2686 · Security Note
• https://t.me/CVEtracker/45043 · Telegram Post
• https://twitter.com/CVEnew/status/2026265065154822314 · Twitter Post
• https://vuldb.com/?id.346488 · Note
• https://twitter.com/TheHackerWire/status/2024277548147032478 · Twitter Post
• https://twitter.com/CVEarity/status/2024391632309932286 · Twitter Post
• https://vuldb.com/?submit.754200 · Note
• https://vuldb.com/?ctiid.346488 · Note
• https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md · Note
• https://twitter.com/0dayPublishing/status/2024275237198549180 · Twitter Post