KodBox CVE-2026-18720

The vulnerable endpoint /index.php?plugin/msgWarning/action must be reachable over the network - the CVSS 4.0 AV:N/AC:L/PR:N/UI:N confirms no authentication is required, no special network position is needed, and no user interaction is necessary. The msgWarning plugin must be present and active (it appears to be a default or standard plugin for KodBox 1.67 Build 02, though this is not explicitly confirmed by vendor documentation). No specific non-default configuration is cited as required. Exploitation is limited in impact by the confidentiality-only outcome (VC:L); attackers cannot modify data or disrupt availability based on the confirmed CVSS impact metrics. Instances not directly exposed to the internet (behind VPN, IP allowlisting, or firewall rules blocking the endpoint) are not exploitable via the network attack vector.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-friction, unauthenticated, network-accessible attack - the ideal conditions for automated exploitation. However, impact is constrained: VC:L indicates only limited confidentiality exposure with no integrity or availability impact confirmed (VI:N/VA:N). The E:P supplemental metric confirms a public exploit exists, elevating urgency above what the base score alone suggests. No CISA KEV listing means mass exploitation has not yet been observed or confirmed by U.S. government sources. EPSS data was not provided, preventing a probability-of-exploitation comparison. The combination of no auth required, public PoC, and an unresponsive vendor with no patch creates a meaningful prioritization signal for internet-exposed KodBox deployments, even if the impact ceiling is low. The absence of vendor response eliminates the usual advisory confirmation pathway, meaning affected version range beyond 1.67 Build 02 remains unconfirmed.

An unauthenticated attacker identifies a KodBox instance exposed to the internet and sends a crafted HTTP request directly to /index.php?plugin/msgWarning/action, exploiting the absent or bypassable authorization check to access data or functionality restricted to authenticated users. A public proof-of-concept has been published at https://github.com/sjmycz/cve/issues/4, lowering the bar for exploitation to script-kiddie level. Given AC:L and no required interaction, this attack is automatable at scale against discoverable KodBox instances.