by Kastro
Paper/Archive/CVE-2026-6349

CVE-2026-6349

HGiga iSherlock-base-4.5 — HGiga｜iSherlock - OS Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.0.810 × 2016.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The  iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

Affected

ProductAffectedFixed inSource
iSherlock-base-4.5< 476476CNA
iSherlock-audit-4.5< 261261CNA
iSherlock-base-5.5< 476476CNA
iSherlock-audit-5.5< 261261CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10842-3f255-1.htmlwriteuptwcert.org.tw/en/cp-139-10841-4f504-2.html