Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Command injection disclosed in Orchid VMS and WebADM

1 source · 2 articlesFirst reported Updated ()3 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers disclosed authenticated command injection in Orchid VMS 26.3.0 to root and WebADM 2.4.14 as uid 999, both scored 7.2, with no CVE or known exploitation.

The 0day Rubbish Research Team published two separate authenticated operating-system command-injection disclosures on 2026-10-06, both scored 7.2, with no CVE identifiers and no statement of exploitation in the wild. In IPConfigure Orchid VMS, installed as Orchid Recorder 26.3.0, the server property package.dnf.repo.gpg_key is written without character validation and can lead to command injection as root; the disclosure cites CWE-78, CWE-20, and CWE-250. Separately, RCDevs WebADM 2.4.14 Freeware Edition, the closed-source IAM and MFA console from RCDevs Security SA that fronts OpenOTP, SpanKey, and TiQR, allows injection via the administrator log viewer's sid command, running code as webadm uid 999. The sources do not disagree; they cover distinct products and injection points rather than conflicting accounts of one flaw.

Key facts
  • On 2026-10-06 the 0day Rubbish Research Team published two separate authenticated OS command-injection disclosures; neither names a CVE or states observed exploitation.
  • IPConfigure Orchid VMS, installed as Orchid Recorder 26.3.0, writes package.dnf.repo.gpg_key without character validation; injection yields root and is scored 7.2, with CWE-78, CWE-20, and CWE-250 cited.
  • RCDevs WebADM 2.4.14 Freeware Edition allows injection through the administrator log viewer's sid command, executing code as webadm uid 999, also scored 7.2.
  • WebADM is the closed-source IAM and MFA console from RCDevs Security SA in Luxembourg and fronts OpenOTP, SpanKey, and TiQR.
  • The reports do not conflict; they describe different products and injection points, both lacking an in-the-wild exploitation claim.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
RCDevsIPConfigure
Products
WebADMOpenOTPSpanKeyTiQROrchid VMSOrchid Recorder
Organizations
0day Rubbish Research TeamRCDevs Security SA
Countries
Luxembourg

Coverage

oldest first · one row per article · UTC
  1. · 19d ago Full DisclosureFirst report

    [0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)

    IPConfigure Orchid VMS 26.3.0 allows authenticated command injection through a DNF GPG-key property to root.

  2. · 19d ago Full Disclosure

    [0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)

    Disclosure: RCDevs WebADM 2.4.14 log viewer command injection yields code execution as uid 999.