PT-2026-6684 · Dcn · Dcn Dcme-320

Physicszq · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-2000

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DCN DCME-320 versions up to 20260121

Description A flaw exists in the Web Management Backend component of DCN DCME-320. Specifically, manipulating the ip list argument within the apply config function of the /function/system/basic/bridge cfg.php file can lead to command injection. This issue is remotely exploitable, and details about the exploit have been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 20260121: Avoid using the ip list parameter in the apply config function. Versions up to 20260121: As a temporary workaround, consider restricting access to the /function/system/basic/bridge cfg.php file.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-2000

Affected Products

Dcn Dcme-320

References · 8

• 🔥 https://github.com/physicszq/Routers/tree/main/Dcme · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2000 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2000 · Vendor Advisory
• https://vuldb.com/?ctiid.344548 · Note
• https://twitter.com/CVEnew/status/2019671075291123871 · Twitter Post
• https://vuldb.com/?submit.743455 · Note
• https://t.me/CVEtracker/43902 · Telegram Post
• https://vuldb.com/?id.344548 · Note