EUVD-2026-24953Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials.
AnalysisAI
Server-Side Request Forgery in guardsix (formerly Logpoint) ODBC Enrichment Plugins allows authenticated Operator users to redirect stored database credentials to arbitrary internal systems by modifying connection endpoints without clearing cached credentials. The vulnerability affects versions before 5.2.1 and enables credential misuse against unintended internal databases despite Changed Scope (CVSS S:C) indicating potential cross-boundary impact. EPSS and exploitation data not available; SSVC indicates no known exploitation, non-automatable attack requiring low-privilege authentication, with partial technical impact to confidentiality and integrity.
Technical ContextAI
The vulnerability exists in the ODBC (Open Database Connectivity) Enrichment Plugin component used by guardsix SIEM platform for external database integration. ODBC plugins allow security operations to enrich log data by querying external databases. The flaw is classified as CWE-918 (Server-Side Request Forgery), where insufficient validation of user-supplied connection parameters allows an authenticated user to modify the target Host, IP address, or Port of an existing Enrichment Source while the system incorrectly retains previously stored database credentials. This credential persistence logic error transforms legitimate database connectivity features into an SSRF primitive, enabling internal network scanning and unauthorized database access using valid stored credentials against endpoints chosen by the attacker rather than the originally configured legitimate systems.
RemediationAI
Upgrade ODBC Enrichment Plugins to version 5.2.1 or later, included in guardsix platform version 7.9.0.0. Vendor advisory available at https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source provides specific upgrade guidance. Until patching, implement these compensating controls: (1) Audit all Operator-level user accounts with ODBC Enrichment Source modification permissions and apply principle of least privilege - restrict this permission to minimum required administrators; (2) Enable detailed audit logging for all Enrichment Source configuration changes and monitor for modifications to Host/IP/Port fields followed by connection attempts to unexpected internal IP ranges; (3) Deploy network segmentation to restrict the guardsix platform's outbound database connectivity to explicitly allowed database servers only via firewall rules, blocking access to broader internal networks - note this may impact legitimate enrichment functionality if sources are added; (4) Implement database-side IP allowlisting to reject connections from the guardsix platform to sensitive internal databases not explicitly configured for enrichment. These controls reduce attack surface but may require operational overhead and should be removed once patching is complete.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today