Which versions of Streamax Crocus are affected by CVE-2026-4910?

Streamax Crocus bis version 1.3.44 contains an unauthenticated SQL injection vulnerability in the RemoteFormat.do endpoint that allows remote attackers to execute arbitrary database commands without…

Is there a public PoC exploit available for CVE-2026-4910?

Yes, a public proof-of-concept exploit is available for CVE-2026-4910. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4910?

Within 24 hours: Identify and inventory all systems running Streamax Crocus bis version 1.3.44 or earlier; determine network exposure and implement network-level access controls to restrict traffic to the /RemoteFormat.do endpoint. Within 7 days: Deploy WAF rules to block malicious SQL syntax in the State parameter; disable the RemoteFormat.do endpoint if operationally feasible; monitor application logs for SQL injection attempts. Within 30 days: Contact Shenzhen Ruiming Technology directly for patch availability and timeline; evaluate replacement or upgrade options; conduct forensic review of logs and databases for evidence of exploitation.

Streamax Crocus CVE-2026-4910

Q: What is the CVSS score of CVE-2026-4910?

CVE-2026-4910 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16532 MEDIUM

SQL Injection (CWE-89)

2026-03-27 VulDB

GHSA-pvrh-63rh-cj2q

SQLi Streamax Crocus

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 04:00 euvd

EUVD-2026-16532

Analysis Generated

Mar 27, 2026 - 04:00 vuln.today

CVE Published

Mar 27, 2026 - 03:01 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus bis 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Shenzhen Ruiming Technology Streamax Crocus bis version 1.3.44 allows unauthenticated remote attackers to execute arbitrary SQL commands via the State parameter in the /RemoteFormat.do endpoint. Publicly available exploit code exists, as documented in a Feishu document linked in VulDB disclosure 353661. The vendor was notified but has not responded, leaving users without a vendor-acknowledged remediation path. With a CVSS score of 7.3 and network-accessible attack vector requiring no privileges, this represents a significant risk to exposed systems.

Technical ContextAI

The vulnerability affects the Streamax Crocus bis product (CPE: cpe:2.3:a:shenzhen_ruiming_technology:streamax_crocus:*:*:*:*:*:*:*:*) manufactured by Shenzhen Ruiming Technology, specifically version 1.3.44. This is a classic SQL injection vulnerability (CWE-89) occurring in the /RemoteFormat.do endpoint component where user-supplied input in the State argument is improperly sanitized before being incorporated into SQL queries. SQL injection vulnerabilities arise when applications construct database queries by concatenating strings with user input rather than using parameterized queries or prepared statements, allowing attackers to manipulate the SQL logic and access or modify database contents beyond intended authorization boundaries.

RemediationAI

No vendor-released patch identified at time of analysis, as Shenzhen Ruiming Technology has not responded to vulnerability disclosure. Until a patch becomes available, organizations should immediately isolate affected Streamax Crocus bis 1.3.44 systems from public internet access using firewall rules or network segmentation. Implement a web application firewall (WAF) with SQL injection signature detection to filter malicious requests targeting the /RemoteFormat.do endpoint. Specifically block or sanitize the State parameter to prevent SQL command injection. Monitor database and application logs for suspicious queries or unauthorized access attempts. If the system must remain internet-accessible, restrict access to trusted IP ranges only and implement strong authentication at the network perimeter. Consider replacing the product with an actively maintained alternative if the vendor continues to be unresponsive to security concerns.