OCO-Server CVE-2026-114611

Requires that the OCO-Server Apple MDM feature be enabled (introduced in v1.2.0) and that the /api-mdm.php/profile endpoint be network-reachable, running an affected version (>=1.2.0, <1.2.3). The attacker must know the serial number of an already-registered victim device, which is supplied verbatim in the forged plist's SERIAL field; no authentication, credentials, or user interaction are needed (PR:N/UI:N) and any self-signed certificate is accepted because of the PKCS7_NOVERIFY flag. The only practical limiting factor is knowledge of a valid registered serial number - a weak barrier since serials appear in asset inventories, invoices, and on device labels - and the device must already exist in the mobile_device table.

This is a genuine high priority, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) is corroborated by the mechanism in the GHSA advisory: openssl_pkcs7_verify() is called with PKCS7_NOVERIFY on the Apple MDM /profile enrollment endpoint, disabling signer chain/trust validation, so any self-signed certificate satisfies the check and the attacker-controlled SERIAL field is trusted. The vuln.today decision label is act_now and a vendor patch (1.2.3) is available, which together argue for prompt remediation. The one real-world moderating factor is that exploitation requires knowing a registered device's serial number - but the advisory notes serials are commonly exposed in asset inventories, invoices, and on the devices themselves, so this is a weak barrier rather than a true secret. No EPSS score and no CISA KEV entry are present in the input; the absence of an EPSS figure means widespread-exploitation probability cannot be quantified here, and the lack of KEV means active exploitation is not confirmed. There is no public weaponized exploit, but the GHSA advisory publicly documents complete, verified reproduction steps (verified 2026-09-03 against v1.2.2), lowering the effort to reproduce. Net: a reachable, unauthenticated, low-complexity flaw with high confidentiality and integrity impact against a self-hosted product - treat as urgent for any exposed OCO-Server MDM deployment.

An attacker who learns the serial number of a device managed by an exposed OCO-Server (from an asset list, invoice, or the device casing) crafts a PKCS#7-signed enrollment plist setting SERIAL to the victim device and an attacker-chosen UDID, signed with a throwaway self-signed certificate. They POST it unauthenticated to /api-mdm.php/profile and receive a .mobileconfig containing a certificate (CN=<serial>) issued by the server's internal MDM CA together with its matching private key, letting them impersonate the device on all subsequent MDM traffic. The GHSA advisory publicly documents verified reproduction steps (tested against v1.2.2 in a Docker sandbox), though no public weaponized exploit code is identified in the input.