0day Rubbish Research Team discloses two same-day flaws: unauthenticated SYSTEM execution in CaptureBites MetaServer and root command injection in Opengear NGCS 25.11.8

Two Full Disclosure posts on 2026-09-22 from the 0day Rubbish Research Team detail a CVSS 9.8 unauthenticated code-execution flaw in CaptureBites MetaServer (as NT AUTHORITY\SYSTEM) and a CVSS 8.8 authenticated root command-injection flaw in Opengear NGCS…

The 0day Rubbish Research Team posted two vulnerability disclosures to the Full Disclosure mailing list on 2026-09-22. The first describes an unauthenticated flaw in CaptureBites MetaServer: an anonymous WCF SOAP workflow can reach the RunPrograms action (CWE-306), resulting in arbitrary command execution as NT AUTHORITY\SYSTEM on the MetaServer host, scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No product build version is given. The second describes an authenticated command-injection flaw in Opengear NGCS 25.11.8 (CWE-78): an administrator-supplied PDU name is passed to Lua io.popen, allowing OS commands to run as root on the out-of-band console manager, scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Both posts link a full technical analysis and a reproducible proof of concept. Neither post names a CVE identifier, and neither claims in-the-wild exploitation. No facts conflict between the two reports; they cover different products from the same research team on the same date.

• Both disclosures were posted to Full Disclosure on 2026-09-22 by the 0day Rubbish Research Team (timestamps 18:31:15Z and 18:31:21Z).
• CaptureBites MetaServer: an anonymous WCF SOAP workflow can invoke the RunPrograms action, classified CWE-306 (missing authentication), enabling unauthenticated arbitrary command execution as NT AUTHORITY\SYSTEM.
• CaptureBites MetaServer flaw scored CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no build version was specified in the post.
• Opengear NGCS 25.11.8: an authenticated administrator can inject OS commands via a PDU name that reaches Lua io.popen, executed as root; classified CWE-78.
• Opengear flaw scored CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• Both posts claim a full technical analysis and a reproducible proof of concept; neither names a CVE identifier nor claims observed in-the-wild exploitation.