EUVD-2026-63165
GHSA-v2jj-5g64-rxp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Management API with no authentication required (PR:N per CVSS 4.0 source); OS command injection yields full host C/I/A compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
OS command injection in chenhg5 cc-connect up to and including v1.4.1 allows remote attackers to execute arbitrary operating system commands by manipulating the exec argument passed to the shellExecCommand function in core/engine.go via the Management API. The CVSS 4.0 vector (PR:N) indicates no authentication is required, making this network-exploitable without credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Management API must be network-accessible - exploitation is possible remotely with no authentication required per the CVSS 4.0 PR:N rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The risk signals present a notable conflict worth flagging. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote unauthenticated attacker sends a crafted HTTP request to the cc-connect Management API endpoint, supplying a malicious value in the `exec` argument (e.g., appending shell metacharacters such as `; id` or `$(whoami)`) that is passed without sanitization to `shellExecCommand` in `core/engine.go`. The injected OS command executes under the process privileges of the cc-connect service on the host. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the GitHub issue was closed due to maintainer inactivity with no fix committed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today