Loading story…
A publicly disclosed vulnerability in vMix 29 (29.0.0.48) allows pre-authentication remote code execution through the product’s Web Controller on port 8088. The flaw is exposed via the GET /api/?Function=ScriptStartDynamic&Value=<VB.NET source> endpoint, which compiles and runs attacker-supplied VB.NET code using VBScriptProvider.Compile. Although vMix attempts to prevent abuse with a six-item substring blocklist, researchers showed the generated compilation template includes Imports System.Diagnostics, enabling attackers to reach Process.Start without using blocked terms and bypass the intended restrictions.
The issue is especially severe because the Web Controller defaults to a blank password, and vendor documentation indicates that a blank password means no login is required regardless of access settings, leaving the API reachable without authentication. Successful exploitation can deliver arbitrary OS command execution and arbitrary file read/write with the privileges of vMix64.exe, which is commonly run as an administrator account. The advisory rates the flaw CVSS 9.8 and describes it as a critical exposure in a product that had not previously been assigned public CVEs.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The same vMix 29 remote code execution advisory was subsequently distributed through the Full Disclosure mailing list. The posting reiterated that the flaw allowed unauthenticated arbitrary OS command execution and file read/write through the ScriptStartDynamic endpoint.
0day Rubbish Research Team publicly disclosed a pre-authentication remote code execution vulnerability affecting Studio Coast Pty Ltd's vMix 29 version 29.0.0.48. The advisory described unauthenticated exploitation via the Web Controller API, rated the issue CVSS 9.8, and made a proof of concept publicly available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **pre-authentication remote code execution** vulnerability has been publicly disclosed in **Vicon Valerus ViconNet Gateway** version `25.200.46.0`. The flaw affects the ASP.NET Web API endpoint `POST /NVR/api/v1/upgrades/multiformat-file-Execute/start`, where attacker-controlled input is concatenated into `cmd.exe /c` and launched through `Process.Start`, allowing arbitrary command execution. Researchers said the endpoint is reachable without authentication and bypasses an authorization gate, enabling remote attackers with network access to ports `8084` or `8444` to execute code as **`NT AUTHORITY\SYSTEM`**. The advisory warns that successful exploitation can result in full compromise of the video management host, including access to recorded footage, camera credentials, and VMS configuration, as well as the ability to alter surveillance operations or destroy evidence. The issue was disclosed by the **0day Rubbish Research Team**, which published both an advisory and a proof of concept, increasing the likelihood of near-term exploitation against exposed systems.
Aug 6, 2026
Public advisories disclosed multiple severe vulnerabilities in **Square Box Systems CatDV Server 10.7.8**, including a **pre-authentication root remote code execution** chain, **hardcoded/default administrator credentials**, and an **authenticated root RCE** through property injection. The most serious issue allows an unauthenticated attacker to reach code execution as `root` by abusing an RMI `connect(null)` path, weak authorization around `saveSettings`, and execution of an attacker-controlled `catdv.aaftoolPath` during AAF export; researchers reported dynamic verification showing `uid=0(root)` on successful exploitation. Separate advisories said CatDV Server can also expose the built-in `admin` account with a factory-default **empty password**, enabling administrative access where defaults were not changed. In addition, an authenticated administrator can reportedly achieve root command execution directly by injecting JVM properties without restarting the server. The vulnerabilities and proof-of-concept details were published by the **0day Rubbish Research Team**, increasing the risk of immediate exploitation against exposed or poorly configured CatDV deployments.
Aug 6, 2026
**CVE-2022-25369** is a critical pre-authentication logic flaw affecting Dynamicweb versions prior to `9.12.8`, including releases `9.5.0` through `9.12.7`. Improper handling of the user-controlled `Action` parameter lets an unauthenticated attacker re-enter the application's setup workflow after installation and access setup actions that should no longer be available. An attacker can use the exposed workflow to create a privileged administrator account, log in to the administrative panel, and upload an ASPX web shell for server-side command execution. The vulnerable logic reportedly existed from August 2018; Dynamicweb confirmed Assetnote's January 2022 disclosure and issued hotfixed releases to supported branches, with fixes rolled out to customers on January 24, 2022.
Sep 3, 2026