Loading story…
A critical security vulnerability was identified in NETSAS Enigma Network Management System (NMS) versions prior to 65.0.0, specifically involving an OS command injection flaw in the discover_and_manage CGI script. This vulnerability, tracked as CVE-2019-16072, allows authenticated attackers to escalate privileges and execute arbitrary operating system commands on the affected server. The root cause of the issue is improper neutralization of shell metacharacters in the ip_address variable when the snmp_browser action is invoked, enabling attackers to inject malicious commands. Security researchers have provided detailed technical analysis and proof-of-concept exploits, demonstrating how an attacker with valid credentials can leverage this flaw to gain unauthorized control over the system. The vulnerability has been cataloged in the National Vulnerability Database and is referenced in multiple security advisories and exploit databases. In response, detection templates have been developed for automated vulnerability scanning tools, such as ProjectDiscovery's Nuclei, to help organizations identify exposed Enigma NMS instances. These templates facilitate the detection of vulnerable systems by matching specific HTTP response patterns and metadata associated with Enigma NMS deployments. Additional detection configurations have been contributed to open-source repositories, enabling security teams to efficiently locate and assess the risk of this vulnerability within their environments. The community has also provided guidance on using search engines like Shodan and Fofa to discover potentially affected Enigma NMS installations on the internet. Remediation steps include updating Enigma NMS to version 65.0.0 or later, which addresses the command injection flaw. Organizations are urged to review their Enigma NMS deployments, apply available patches, and restrict access to management interfaces to mitigate exploitation risk. The vulnerability is considered significant due to the potential for full system compromise if exploited by a malicious actor. Security professionals recommend continuous monitoring and regular vulnerability assessments to ensure that all instances of Enigma NMS are secured against this and similar threats. The collaborative efforts of the security community have resulted in improved detection and awareness, helping organizations respond proactively to this critical issue. The availability of detection templates and public advisories underscores the importance of timely patching and defense-in-depth strategies for network management systems. This incident highlights the ongoing need for secure coding practices and thorough input validation in web-based management applications. By leveraging community-contributed detection tools and following best practices, organizations can reduce their exposure to privilege escalation and command injection attacks targeting Enigma NMS.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request or issue was created to add a Nuclei template file for CVE-2021-45467, labeled vKEV. The available reference contains workflow activity but no substantive technical details about the vulnerability itself.
A Nuclei pull request was opened to add a template for detecting or validating CVE-2019-16072 in Enigma NMS, describing it as a privilege-escalation OS command injection issue and marking it as KEV-related.
A Nuclei pull request was opened to add detection configuration for Enigma NMS, indicating public security detection work for the product. The reference does not include technical details beyond the addition request.
A privilege-escalation OS command injection vulnerability, tracked as CVE-2019-16072, was identified in Enigma NMS versions earlier than 65.0.0. The reference does not provide the original disclosure date, only that the issue is later treated as known and exploitable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability has been identified in the MegaSys Enterprises Telenium Online Web Application, allowing unauthenticated attackers to execute arbitrary operating system commands on affected servers. The flaw, tracked as CVE-2025-10659, arises from improper input handling in a PHP endpoint that is accessible over the network without authentication. Specifically, the vulnerability is due to insecure termination of a regular expression check, which fails to adequately validate or sanitize user-supplied input. As a result, attackers can craft malicious HTTP requests that inject OS commands, leading to remote code execution within the security context of the web application service account. The vulnerability affects Telenium Online Web Application versions 8.4.21 and prior, as confirmed by both CVE and CISA advisories. The issue is classified as an OS command injection (CWE-78), a category of vulnerabilities known for their high impact and ease of exploitation. The CVSS v3.1 base score for this vulnerability is 9.8, indicating a critical risk, while a CVSS v4 score of 9.3 further underscores its severity. The vulnerability is remotely exploitable and requires no user interaction or authentication, making it particularly dangerous for internet-exposed systems. Successful exploitation could allow attackers to gain control over the affected server, potentially leading to data theft, service disruption, or lateral movement within the network. The vulnerability was disclosed by ics-cert@hq.dhs.gov and has been publicly documented in both CVE and CISA ICS advisories. Organizations using the Telenium Online Web Application are strongly advised to review their deployments and apply any available patches or mitigations. The advisories do not specify the exact versions affected beyond 8.4.21 and prior, so all users of the product should consider themselves at risk until further information is available. No reports of exploitation in the wild have been confirmed at the time of the advisories' publication, but the low attack complexity and high impact make rapid remediation essential. The vulnerability highlights the ongoing risks associated with improper input validation in web applications, especially those used in industrial control system environments. Security teams should prioritize network segmentation and monitoring for unusual HTTP request patterns targeting the vulnerable endpoint. The incident serves as a reminder of the importance of secure coding practices and regular security assessments for critical infrastructure software.
Jun 29, 2026
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
Smartbedded Meteobridge devices have been found to contain a critical command injection vulnerability, tracked as CVE-2025-4008, which affects the management web interface endpoint /public/template.cgi. The flaw arises from improper neutralization of user-supplied input, which is parsed and used unsanitized in an eval call, allowing for remote (adjacent), unauthenticated attackers to execute arbitrary commands with root privileges. This vulnerability has been rated as high severity, with a CVSS score of 8.8, and there is confirmed evidence of active exploitation in the wild. Devices running Meteobridge versions prior to 6.2 are vulnerable to this exploit, making a significant number of systems potentially at risk if not updated. Successful exploitation could result in complete system compromise, giving attackers full control over the affected device. In response, Smartbedded has released an update, and users are strongly encouraged to upgrade to version 6.2 or later to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recognized the seriousness of this vulnerability by adding CVE-2025-4008 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the need for immediate remediation. CISA’s inclusion of this flaw in the KEV catalog underscores the active threat it poses to organizations and individuals using Meteobridge devices. Security researchers have provided guidance on how to identify potentially vulnerable systems, including specific queries that can be used to locate affected assets within network inventories. The vulnerability is part of a broader set of flaws added to the KEV catalog, but CVE-2025-4008 is specifically noted for its active exploitation and potential for severe impact. Organizations are advised to prioritize patching and to review their inventories for any exposed Meteobridge devices. The disclosure and subsequent response demonstrate the ongoing risks associated with IoT and network management devices, which often have elevated privileges and are attractive targets for attackers. The rapid addition of this vulnerability to the KEV catalog reflects the urgency with which defenders must act to prevent compromise. The technical details of the vulnerability, including the use of unsanitized input in an eval call, highlight the importance of secure coding practices in web interfaces. The incident serves as a reminder for organizations to maintain up-to-date patching processes and to monitor advisories from both vendors and government agencies. Failure to address this vulnerability could result in attackers leveraging compromised Meteobridge devices as footholds for further attacks within a network. The situation remains dynamic, with ongoing monitoring recommended to detect any signs of exploitation or compromise related to this vulnerability.
Jun 29, 2026