Which versions of Streamax Crocus are affected by CVE-2026-4910?

Streamax Crocus bis version 1.3.44 contains an unauthenticated SQL injection vulnerability in the RemoteFormat.do endpoint that allows remote attackers to execute arbitrary database commands without…

Is there a public PoC exploit available for CVE-2026-4910?

Yes, a public proof-of-concept exploit is available for CVE-2026-4910. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4910?

Within 24 hours: Identify and inventory all systems running Streamax Crocus bis version 1.3.44 or earlier; determine network exposure and implement network-level access controls to restrict traffic to the /RemoteFormat.do endpoint. Within 7 days: Deploy WAF rules to block malicious SQL syntax in the State parameter; disable the RemoteFormat.do endpoint if operationally feasible; monitor application logs for SQL injection attempts. Within 30 days: Contact Shenzhen Ruiming Technology directly for patch availability and timeline; evaluate replacement or upgrade options; conduct forensic review of logs and databases for evidence of exploitation.

Streamax Crocus CVE-2026-4910

Q: What is the CVSS score of CVE-2026-4910?

CVE-2026-4910 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16532 MEDIUM

SQL Injection (CWE-89)

2026-03-27 VulDB

GHSA-pvrh-63rh-cj2q

SQLi Streamax Crocus

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 04:00 euvd

EUVD-2026-16532

Analysis Generated

Mar 27, 2026 - 04:00 vuln.today

CVE Published

Mar 27, 2026 - 03:01 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus bis 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Shenzhen Ruiming Technology Streamax Crocus bis version 1.3.44 allows unauthenticated remote attackers to execute arbitrary SQL commands via the State parameter in the /RemoteFormat.do endpoint. Publicly available exploit code exists, as documented in a Feishu document linked in VulDB disclosure 353661. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates this is a remotely exploitable vulnerability requiring no authentication, low attack complexity, and no user interaction, with low impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker identifies an internet-exposed Streamax Crocus bis 1.3.44 installation through network scanning. Using the publicly available exploit code from the Feishu document, the attacker crafts a malicious HTTP request to /RemoteFormat.do with SQL injection payloads in the State parameter. …
Remediation	No vendor-released patch identified at time of analysis, as Shenzhen Ruiming Technology has not responded to vulnerability disclosure. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all systems running Streamax Crocus bis version 1.3.44 or earlier; determine network exposure and implement network-level access controls to restrict traffic to the /RemoteFormat.do endpoint. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-4910 vulnerability details – vuln.today

Back