EUVD-2026-43217
GHSA-g497-v9rm-7w4w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible WebSocket requires PR:L per CVSS vector; CWE-78 OS command injection on a server host realistically yields full system access, warranting C:H/I:H/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component Android WebSocket Server. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
OS command injection in SonicCloudOrg sonic-agent (all versions up to 2.7.2) enables remote code execution through the Android WebSocket Server component. An authenticated remote attacker can manipulate the path argument in AndroidWSServer.java to inject arbitrary OS commands on the host running the agent. Publicly available exploit code exists (GitHub PoC by xpp3901), no vendor patch will be issued as the product is end-of-life, and the vendor is unresponsive to disclosure - creating a permanent, unmitigable risk for any active deployment.
Technical ContextAI
sonic-agent is a Java-based mobile device management and testing agent developed by SonicCloudOrg, designed to facilitate Android device operations over WebSocket connections. The vulnerable component, AndroidWSServer.java, implements an Android WebSocket Server that processes client requests including file retrieval operations. The path parameter supplied by clients is not sanitized before incorporation into an OS-level command invocation, producing a classic OS Command Injection (CWE-78) flaw - the most direct form of this root cause class, where attacker-controlled data is concatenated into a shell command string. An attacker appending shell metacharacters (semicolons, backticks, pipe characters) to the path argument can break out of the intended command context and execute arbitrary system commands in the OS user context of the sonic-agent process. The CPE identifier cpe:2.3:a:soniccloudorg:sonic-agent:*:*:*:*:*:*:*:* covers all versions through 2.7.2. The GitHub PoC repository name ('pullFile_CmdInjection_RCE') identifies the pullFile feature as the specific attack surface.
RemediationAI
No vendor-released patch exists - sonic-agent is end-of-life and the vendor did not respond to disclosure. Organizations running any version of sonic-agent through 2.7.2 should apply the following compensating controls in priority order: first, disable the Android WebSocket Server entirely if not operationally required - eliminating the service removes the attack surface completely, with the trade-off of losing Android device management functionality; second, restrict network access to the WebSocket port using host firewall rules or network ACLs to allow only explicitly trusted IP addresses, which limits the AV:N vector to a controlled network segment but does not eliminate the vulnerability if an attacker is within the allowed range; third, if the agent must remain running, deploy it behind an authenticated reverse proxy enforcing stronger access controls than the built-in low-privilege mechanism, adding operational overhead but reducing unauthenticated exposure; and fourth, plan migration to a maintained Android device testing framework, as running unsupported software with a public PoC and no remediation path represents sustained, unmitigable organizational risk. The PoC at https://github.com/xpp3901/CVE_APPLY/tree/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE can inform internal testing to confirm exposure.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today