Loading story…
Public advisories disclosed multiple severe vulnerabilities in Square Box Systems CatDV Server 10.7.8, including a pre-authentication root remote code execution chain, hardcoded/default administrator credentials, and an authenticated root RCE through property injection. The most serious issue allows an unauthenticated attacker to reach code execution as root by abusing an RMI connect(null) path, weak authorization around saveSettings, and execution of an attacker-controlled catdv.aaftoolPath during AAF export; researchers reported dynamic verification showing uid=0(root) on successful exploitation.
Separate advisories said CatDV Server can also expose the built-in admin account with a factory-default empty password, enabling administrative access where defaults were not changed. In addition, an authenticated administrator can reportedly achieve root command execution directly by injecting JVM properties without restarting the server. The vulnerabilities and proof-of-concept details were published by the 0day Rubbish Research Team, increasing the risk of immediate exploitation against exposed or poorly configured CatDV deployments.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
A Full Disclosure mailing list post publicly disclosed the three severe CatDV Server 10.7.8 vulnerabilities, including the pre-authentication root RCE chain, hardcoded/default admin credentials, and authenticated root RCE. The post stated that successful exploitation was dynamically verified to achieve uid=0(root) and pointed to public advisories and PoC code.
On 0day-rubbish.com, the 0day Rubbish Research Team published advisories covering three vulnerabilities in Square Box Systems CatDV Server 10.7.8: a factory-default empty admin password issue, an authenticated root RCE via aaftoolPath property injection, and an unauthenticated RMI-based root RCE chain. The disclosures included technical analysis and proof-of-concept material referenced by the sources.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open source0day-rubbish.com
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public advisories disclosed two **root-level remote code execution** vulnerabilities in **atvise SCADA 3.13.0** from atvise GmbH / Bachmann Visutec, affecting deployments with the `WEBACCESS` module enabled. One flaw allows **pre-authentication** compromise through an **OPC UA authentication bypass** on port `4840`, which can be chained with WebMI script tampering and anonymous request paths to execute arbitrary commands as `root`. The second issue is an **authenticated default-credential RCE** in WebHMI/WebMI, where a built-in `root` account ships with an empty password and a login branch can grant a superuser session without proper password verification while that default state remains. Researchers said successful exploitation can lead to **complete host compromise**, including arbitrary command execution, file access, and manipulation of SCADA control logic and node values. The advisory noted that `WEBACCESS` is normally loaded in licensed production deployments, increasing practical exposure, and said **proof-of-concept code** and full technical analysis were released publicly through Full Disclosure and separate write-ups covering the OPC UA unauthenticated attack path and the WebMI default-credential RCE.
Aug 6, 2026
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
Two critical server-side vulnerabilities have exposed widely deployed web applications to full remote compromise without authentication. In **AVideo**, `CVE-2025-34433` was rated **CVSS 10.0** after researchers reported a deterministic cryptographic failure that enables immediate remote code execution during normal HTTP request processing. Successful exploitation can grant attackers the privileges of the web server process, with broad read and write access to the application directory, internal database, and uploaded media, creating a complete confidentiality, integrity, and availability failure. The flaw is considered highly reliable because it does not depend on memory corruption and is not meaningfully hindered by mitigations such as ASLR, DEP, or stack canaries; reports also noted the existence of weaponized exploit modules. A separate **actively exploited** flaw, `CVE-2026-22679`, affects **Weaver (Fanwei) E-cology 10.0** builds before `20260312`. The vulnerability stems from an exposed debug endpoint that forwards attacker-controlled JSON into the **Dubbo RPC** framework without authentication or validation, allowing arbitrary operating system command execution through the Java application running under **Tomcat**. Threat intelligence tied exploitation to internet-facing systems shortly after the vendor patch, with observed activity including `ping`-based verification, PowerShell payload retrieval, attempted MSI deployment, and evasive techniques such as renamed PowerShell binaries and in-memory execution. Defenders were urged to upgrade affected systems, watch for suspicious child processes spawned by `java.exe`, and review EDR telemetry for obfuscated or fileless post-exploitation behavior.
Jun 29, 2026