GCVE-1988-2026-0058

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon \nIndustries). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nVicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to \n/NVR/api/v1 on ports 8084/8444. The endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a \n[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes Process.Start. None of the 8 OWIN \nmiddlewares perform authentication, UpgradesController is not annotated with [Authorize], and SetupExecuteCommand \nbypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() method. The service runs as LocalSystem, \nso an unauthenticated attacker with network access to the Web API port immediately obtains nt authority\\system remote \ncode execution.\n\nImpact: Full host compromise as nt authority\\system with no credentials required; the attacker can access all recorded \nvideo, camera credentials, and VMS configuration, alter video surveillance state, and tamper with or destroy evidence.\n\nAdvisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/11"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0058",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11",
            "automated": true,
            "contentSha256": "4bca9118108632e68858fe19a14bea30d3ae2f8f7886c0c397caf138b0225f2a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0058"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}