0day Rubbish Research Team (Organization): news timeline & CVEs

[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)

0day Rubbish disclosed authenticated root command execution in Server Technology PRO3X PDUs on firmware 030600.

The 0day Rubbish Research Team publicly disclosed a vulnerability in Server Technology (Legrand) PRO3X intelligent rack PDUs. Firmware spdu-pro3x-030600 build 46640 lets an authenticated attacker override the port_mux listener and run commands as root (CWE-78, CWE-269). A separate hard-coded factory credential is also reported (CWE-798). The post cites no CVE and does not say the flaw is being exploited.

Full Disclosure04:12 UTC · 6h agoVulnerability 5 sources

[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

Logo Netsis NetOpenX REST 2.0.6.9 allows unauthenticated SQL injection that can run commands as SYSTEM.

0day Rubbish Research Team disclosed a flaw in Logo Netsis NetOpenX REST 2.0.6.9, the REST API gateway for the Netsis enterprise ERP suite. An unauthenticated SQL injection in the OAuth 2.0 token endpoint can lead to operating-system command execution through SQL Server xp_cmdshell. The issue is scored 9.8 and mapped to CWE-89, CWE-306, and CWE-78. The post cites no CVE and does not report exploitation in the wild.

Full Disclosure04:12 UTC · 6h agoVulnerability 5 sources1· 1 read

[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)

MultiTech Conduit AEP 6.3.6 has an authenticated filename injection that can yield root on IoT gateways.

0day Rubbish Research Team disclosed an authenticated OS command-injection flaw in MultiTech Conduit AEP 6.3.6, used on mtcdt, mtcdtip, and mtcdtiphp IoT gateways running mLinux. The admin-only import_config handler can be abused through an uploaded filename to gain root command execution (CWE-78). The management API is served on TCP port 8080. The issue is scored 7.2 and is not described as exploited in the wild.

Full Disclosure04:12 UTC · 6h agoVulnerability 5 sources

[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

Researchers disclosed an unauthenticated JMX flaw in Lightstreamer Server 7.4.8 that can load native code in the JVM.

The 0day Rubbish Research Team disclosed an unauthenticated access flaw in Lightstreamer Server 7.4.8 build 3506 with JMS Extender 2.1.0. An anonymous caller can use the JMX inspection console to invoke MBean operations, including loading a native agent into the broker JVM. The report cites CWE-306, CWE-345, CWE-20, CWE-250 and CWE-1188 and scores the issue 8.1. No CVE or in-the-wild exploitation is mentioned.

Full Disclosure04:12 UTC · 6h agoVulnerability 2 sources

[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)

Lightstreamer Server 7.4.8 ships placeholder JMX credentials that enable remote class loading and root code execution.

Researchers disclosed a flaw in Lightstreamer Server 7.4.8 build 3506 Enterprise with JMS Extender 2.1.0, scored 9.8. The distribution ships placeholder JMX/RMI credentials and exposes a cleartext RMI management connector on TCP 8888 bound to every interface. Access through that connector can lead to remote class loading and root remote code execution. No CVE or observed exploitation is stated.

Full Disclosure04:12 UTC · 6h agoVulnerability 2 sources

[0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)

Lantronix SGX5150 firmware has an authenticated command-injection flaw that can yield root code execution.

The 0day Rubbish Research Team disclosed an authenticated OS command injection (CWE-78) in Lantronix SGX5150 firmware 9.13.0.0R7, an IT/OT device server. The FsBrowseClean handler insufficiently filters a path parameter, allowing injected commands and root code execution. The issue is scored 7.2. No CVE or in-the-wild exploitation is mentioned.

Full Disclosure04:12 UTC · 6h agoVulnerability 5 sources

[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)

FME Flow 2026.2 has a Zip-Slip flaw that can write arbitrary files and execute code as LocalSystem.

Researchers disclosed a Zip-Slip path traversal (CWE-22) in Safe Software FME Flow 2026.2 build 26333. Archive extraction in StoreManager.extract() uses zip entry names without normalizing parent-directory sequences, allowing arbitrary file writes. The write can lead to code execution as LocalSystem and is scored 8.8. No CVE or observed exploitation is stated.

Full Disclosure04:12 UTC · 6h agoVulnerability

[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)

Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR field allows command injection to root RCE.

The 0day Rubbish Research Team publicly disclosed an OS command injection flaw in Cambium cnMatrix EX3024F firmware 6.2.1-r4. The COMMON_NAME field sent to POST /iss/specific/ssl_digitalcert.html is taken by HttpGetValuebyName and only percent-decoded before use. The issue is described as CWE-78, with CWE-20, CWE-250, and CWE-269 also cited, and is rated 7.2, leading to root remote code execution. No CVE or observed exploitation is stated.

Full Disclosure04:12 UTC · 6h agoVulnerability 5 sources

[0day-rubbish] Opengear NGCS 25.11.8 Authenticated PDU name command injection to root via io.popen (8.8)

Researchers disclosed an authenticated Opengear NGCS 25.11.8 command-injection bug that executes commands as root.

The 0day Rubbish Research Team publicly disclosed an authenticated command-injection flaw in Opengear NGCS 25.11.8. An administrator can supply a PDU name that is passed to Lua io.popen, resulting in root command execution on the out-of-band console manager. The issue is CWE-78 with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The post includes a full technical analysis and a reproducible proof of concept; observed in-the-wild exploitation is not claimed.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC 2 sources

[0day-rubbish] LCDS Laquis SCADA Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (9.8)

Unauthenticated file upload in LCDS Laquis SCADA chains with DLL autoload for code execution, CVSS 9.8.

The 0day Rubbish Research Team disclosed a flaw in LCDS Laquis SCADA that chains an unauthenticated file write at /uploade.html with autoloading of CMDEXT*.DLL files. Successful use runs arbitrary native code in the SCADA web and HMI process, which also hosts the Modbus TCP listener. The issue is CWE-434, scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the default configuration has no password. The posting says a full technical analysis is included; it does not report confirmed in-the-wild exploitation.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC 3 sources

[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)

Unauthenticated file upload in Ecava IntegraXor IGX 16.0.701.10 chains to cmd.exe for Administrator code execution.

0day Rubbish Research Team publicly disclosed an unauthenticated remote code execution flaw in Ecava IntegraXor IGX 16.0.701.10. An unauthenticated /FileUpload write is chained to the dxmanager cmd.exe sink (CWE-306), yielding arbitrary command execution as Administrator on the Web SCADA HMI host. The reported CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The post says a full analysis and reproducible proof-of-concept were published; no CVE or observed exploitation is stated.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC 3 sources

[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)

Authenticated Devolutions Server admins can bypass PAM checks and run SYSTEM PowerShell via a test-script endpoint.

0day Rubbish Research Team disclosed a missing-authorization flaw in Devolutions Server (DVLS) 2026.2.14.0. An authenticated administrator who lacks a PAM licence and PAM role can bypass the PAM entitlement gate and run arbitrary PowerShell as NT AUTHORITY\SYSTEM through the test-script endpoint (CWE-862). CVSS is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). A reproducible proof-of-concept is claimed; the post does not assign a CVE or report exploitation in the wild.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC

[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)

Unauthenticated attackers can trigger CaptureBites MetaServer RunPrograms execution as SYSTEM through an anonymous WCF SOAP workflow.

0day Rubbish Research Team disclosed an unauthenticated code-execution flaw in CaptureBites MetaServer. An anonymous WCF SOAP workflow can invoke RunPrograms (CWE-306), producing arbitrary command execution as NT AUTHORITY\SYSTEM on the MetaServer host. The stated CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The mailing-list post points to a full technical analysis and reproducible proof-of-concept but names no CVE and does not claim in-the-wild use.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC 2 sources

[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)

Unauthenticated upload in PrizmDoc for Java 5.22.1 writes a JSP webshell into the webapp root as root.

0day Rubbish Research Team disclosed an unauthenticated file-upload flaw in PrizmDoc for Java (VirtualViewer) 5.22.1. The uploadDocument function writes into the web application root, allowing a JSP webshell (CWE-306) that executes with the JVM's privileges—uid 0 (root) in the deployment the researchers verified. CVSS is given as 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The post advertises a reproducible proof-of-concept and does not cite a CVE or confirmed exploitation.

Full DisclosureSep 22, 18:31 UTC · 4d agoExploit / PoC 3 sources

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

0day Rubbish Research Team disclosed a CVSS 7.2 local privilege escalation (CWE-250) in Royal Server 5.04.50529.0 to LocalSystem.

Researchers publicly disclosed a local privilege escalation vulnerability in Royal Server 5.04.50529.0, classified as CWE-250 (execution with unnecessary privileges) with a CVSS score of 7.2. The flaw allows escalation to LocalSystem on the execution path without credential override. The disclosure was posted to the Full Disclosure mailing list on September 8, 2026; no patch or CVE id was mentioned in the notice.

Full DisclosureSep 8, 17:31 UTC · 18d agoVulnerability

0day Rubbish Research Team

Timeline15 articles

Appears with

[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)

[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)

[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)

[0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)

[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)

[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)

[0day-rubbish] Opengear NGCS 25.11.8 Authenticated PDU name command injection to root via io.popen (8.8)

[0day-rubbish] LCDS Laquis SCADA Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (9.8)

[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)

[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)

[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)

[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)