Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChigh

0day Rubbish Research Team discloses two same-day flaws: unauthenticated SYSTEM execution in CaptureBites MetaServer and root command injection in Opengear NGCS 25.11.8

1 source · 2 articlesFirst reported Updated ()1
What's new

Initial merged story created from two same-day Full Disclosure posts by the 0day Rubbish Research Team; no previous summary existed. Coverage now spans both the CaptureBites MetaServer unauthenticated SYSTEM-execution disclosure (CVSS 9.8) and the Opengear NGCS 25.11.8 authenticated root command-injection disclosure (CVSS 8.8). No vendor advisories, CVE assignments, or exploitation reports have…

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Two Full Disclosure posts on 2026-09-22 from the 0day Rubbish Research Team detail a CVSS 9.8 unauthenticated code-execution flaw in CaptureBites MetaServer (as NT AUTHORITY\SYSTEM) and a CVSS 8.8 authenticated root command-injection flaw in Opengear NGCS…

The 0day Rubbish Research Team posted two vulnerability disclosures to the Full Disclosure mailing list on 2026-09-22. The first describes an unauthenticated flaw in CaptureBites MetaServer: an anonymous WCF SOAP workflow can reach the RunPrograms action (CWE-306), resulting in arbitrary command execution as NT AUTHORITY\SYSTEM on the MetaServer host, scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No product build version is given. The second describes an authenticated command-injection flaw in Opengear NGCS 25.11.8 (CWE-78): an administrator-supplied PDU name is passed to Lua io.popen, allowing OS commands to run as root on the out-of-band console manager, scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Both posts link a full technical analysis and a reproducible proof of concept. Neither post names a CVE identifier, and neither claims in-the-wild exploitation. No facts conflict between the two reports; they cover different products from the same research team on the same date.

Key facts
  • Both disclosures were posted to Full Disclosure on 2026-09-22 by the 0day Rubbish Research Team (timestamps 18:31:15Z and 18:31:21Z).
  • CaptureBites MetaServer: an anonymous WCF SOAP workflow can invoke the RunPrograms action, classified CWE-306 (missing authentication), enabling unauthenticated arbitrary command execution as NT AUTHORITY\SYSTEM.
  • CaptureBites MetaServer flaw scored CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no build version was specified in the post.
  • Opengear NGCS 25.11.8: an authenticated administrator can inject OS commands via a PDU name that reaches Lua io.popen, executed as root; classified CWE-78.
  • Opengear flaw scored CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
  • Both posts claim a full technical analysis and a reproducible proof of concept; neither names a CVE identifier nor claims observed in-the-wild exploitation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
CaptureBitesOpengear
Products
MetaServerOpengear NGCS
Organizations
0day Rubbish Research Team

Coverage

oldest first · one row per article · UTC
  1. · Sep 22, 2026 Full DisclosureFirst report

    [0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)

    Unauthenticated attackers can trigger CaptureBites MetaServer RunPrograms execution as SYSTEM through an anonymous WCF SOAP workflow.

  2. · Sep 22, 2026 Full Disclosure

    [0day-rubbish] Opengear NGCS 25.11.8 Authenticated PDU name command injection to root via io.popen (8.8)

    Researchers disclosed an authenticated Opengear NGCS 25.11.8 command-injection bug that executes commands as root.