Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

0day Rubbish Research Team discloses two CVSS 8.8 command injection flaws: QuantaStor 6.8.3.018 alert-mail smtpPassword injection and persistent OP5 Monitor 9.20 injection despite…

1 source · 2 articlesFirst reported Updated ()3 · 1 read
What's new

First merged summary for this story. Newly disclosed on 2026-09-08: (1) a CVSS 8.8 command injection in QuantaStor 6.8.3.018's alert-mail command via the smtpPassword field, with no CVE cited and no evidence of active exploitation; and (2) confirmation that OP5 Monitor 9.20 remains vulnerable to a CVSS 8.8 command injection even after the CVE-2025-34115 patch, which is opt-in and described as…

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

On 2026-09-08, 0day Rubbish Research Team disclosed two command injection (CWE-78) flaws, each scoring CVSS 8.8: one in QuantaStor 6.8.3.018's alert-mail command via the smtpPassword field (no CVE cited, no reported exploitation), and one in OP5 Monitor 9.20…

The 0day Rubbish Research Team published two command injection (CWE-78) disclosures on 2026-09-08, each rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with network attack vector, low privilege requirement, and high confidentiality, integrity, and availability impact. The first affects QuantaStor 6.8.3.018, where the alert-mail command can be exploited through the smtpPassword field; the disclosure cites no CVE identifier and no evidence of active exploitation. The second affects OP5 Monitor 9.20, where the command injection persists despite the existing CVE-2025-34115 patch; the researchers describe that vendor fix as opt-in and ineffective, meaning administrators who previously applied it may still be exposed.

Key facts
  • QuantaStor 6.8.3.018: command injection (CWE-78) in the alert-mail command, reachable via the smtpPassword field.
  • OP5 Monitor 9.20: command injection (CWE-78) survives the CVE-2025-34115 patch; the vendor fix is opt-in and deemed ineffective by the researchers.
  • CVE identifiers: CVE-2025-34115 (prior OP5 Monitor fix); no CVE cited for the QuantaStor flaw.
  • Severity: both flaws scored CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (network vector, low privileges required, no user interaction, high C/I/A impact).
  • Disclosure: both published publicly on 2026-09-08 by 0day Rubbish Research Team; the QuantaStor issue was disclosed as a 0day without mention of active exploitation.
  • Exposure note (OP5): administrators who previously applied the CVE-2025-34115 fix may still be exposed.
Analyze CVE-2025-34115 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-34115

Coverage

oldest first · one row per article · UTC
  1. · Sep 8, 2026 Full DisclosureFirst report

    [0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)

    QuantaStor 6.8.3.018 has a CVSS 8.8 command injection in its alert-mail command, exploitable via the smtpPassword field.

  2. · Sep 8, 2026 Full Disclosure

    [0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)

    OP5 Monitor 9.20 remains vulnerable to CVSS 8.8 command injection because the CVE-2025-34115 fix is opt-in and ineffective.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-34115
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint
8.73%