EUVD-2026-69130
GHSA-25fc-9x7f-8x83
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 code injection in a network-facing 'Internet Objects' product with no stated auth or interaction supports AV:N/AC:L/PR:N/UI:N and full C/I/A impact via RCE.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection.
This issue affects KIO (Klemsan Internet Objects): before v1.9.
AnalysisAI
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are stated beyond network access - remote unauthenticated exploitation against affected default configurations of KIO (Klemsan Internet Objects) before v1.9, with no user interaction required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes remote, unauthenticated, low-complexity full compromise, and CWE-94 code injection typically yields direct RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to KIO v1.9 or later, which is the first version outside the affected range and thus the vendor-released fix (Vendor-released patch: v1.9); consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0963 for vendor-specific upgrade guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Klemsan KIO deployments across the organization, document version numbers, and assess network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today