EUVD-2026-93399
GHSA-9hwp-5hjw-2623
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged account
-
DeliverySend crafted request to management function
-
ExploitInject shell metacharacters into OS command
-
ExecutionExecute arbitrary commands on appliance
-
ImpactCompromise directory/identity services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least low-level privileges on the SambaBox appliance (CVSS PR:L), after which a specially crafted input containing unneutralized OS shell metacharacters is passed to a vulnerable command-handling function (CWE-78). The flaw is network-reachable (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), but the requirement for valid credentials is the key limiting factor that distinguishes this from a fully unauthenticated RCE. Affected: all SambaBox versions before 5.4.1; upgrading to 5.4.1 or later remediates. The specific vulnerable feature, endpoint, or parameter is not detailed in the available advisory. |
| Impact | This is a credible, high-priority vulnerability for organizations actually running SambaBox, though several enrichment signals are absent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection requiring only low-level authenticated privileges (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - effectively arbitrary command execution on the appliance OS. These are the hallmarks of a flaw that is easy to weaponize once an attacker has any authenticated foothold. However, key real-world-risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing (and CISA KEV is unlikely to cover a Turkey-specific vendor product in any case), and no indication of public POC availability. The sole reference is a Turkish national CERT (USOM/siberguvenlik.gov.tr) advisory rather than NVD enrichment, so exploitation telemetry is limited. Net: the technical severity is genuinely high and the barrier (one low-privilege account) is low, but absent EPSS/KEV/POC data this should be treated as a patch-promptly item driven by intrinsic severity and the appliance's privileged role, not as confirmed active exploitation. The PR:L requirement is the main real-world limiter. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged authenticated account on a SambaBox appliance (or who obtains such credentials via phishing or reuse) sends a crafted request to a vulnerable management function that fails to neutralize shell metacharacters. The injected OS command executes with the privileges of the appliance service, giving the attacker code execution on a system that typically acts as a domain controller / identity provider. No public exploit code was identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
OS command injection in SambaBox appliances running versions before 5.4.1 allows an attacker who holds a valid but low-privileged account to execute arbitrary operating system commands on the underlying host by supplying shell metacharacters to a command-handling function. The flaw is network-reachable, low-complexity, and requires no user interaction, but the need for an authenticated session (CVSS PR:L) is the key limiting factor that separates it from a fully unauthenticated remote code execution scenario. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in organizations that actually expose SambaBox interfaces to users beyond a trusted management network.
RemediationAI
Vendor-released patch: upgrade SambaBox to version 5.4.1 or later, which is the fixed version identified in the USOM advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1258); this is the primary and definitive fix. Until the upgrade can be scheduled, compensate for the CVSS PR:L requirement by reducing the population of accounts that can reach the vulnerable command-handling functionality - remove or disable unnecessary low-privileged and administrative accounts on the appliance and enforce least privilege, accepting the trade-off that legitimate operators may lose access to features they currently use. Additionally, restrict network reachability of SambaBox management and user interfaces to trusted internal segments or a management VLAN via firewall rules, which reduces the AV:N attack surface but will break remote or off-site administration and any integrations that depend on those endpoints. Because no public exploit code was identified, there is no specific signature to deploy; enable verbose command-execution and authentication logging on the appliance and alert on unusual child processes or shell invocations spawned by the SambaBox service, weighing the added log volume and performance overhead against the detection benefit. Note that the advisory does not name the vulnerable parameter or endpoint, so input-validation hardening cannot be targeted and must not be treated as a substitute for upgrading to 5.4.1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78, improper neutralization of special elements used in an OS command, a class of defect where application-supplied input is concatenated into a shell command string without escaping or argument separation. In SambaBox, input reaches a command-handling function that ultimately invokes an operating system shell, so characters such as semicolons, pipes, backticks, or command substitution syntax are interpreted by the shell rather than treated as literal data, allowing the attacker to append or replace commands under the privileges of the SambaBox service process. The assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity attack that needs only low-level credentials and no victim interaction, with high confidentiality, integrity, and availability impact but no scope change - meaning the compromise is contained within the same security authority as the vulnerable component. The incomplete advisory does not disclose the specific endpoint, parameter, or feature that carries the injection, which complicates signature-based detection and makes input validation review across the appliance's command-invoking code paths the practical analysis approach. No CPE identifiers were supplied in the available intelligence, so affected inventories must be matched by product name and version rather than by structured CPE enumeration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable command injection needing a low-privileged account (PR:L) and no interaction; successful injection yields full OS command execution, so C/I/A all High.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.
This issue affects SambaBox: before 5.4.1.
Executive ViewAI
SambaBox appliances running versions prior to 5.4.1 contain an OS command injection flaw (CVE-2026-85523, CVSS 8.8) that lets a holder of any valid low-privileged account run arbitrary commands on the underlying appliance host over the network. Because the weakness is in a command-handling function of the appliance itself, a single compromised user credential - including stale, shared, or contractor accounts - can escalate to full control of the host, exposing data stored or brokered by the appliance and any downstream systems that trust it. Leadership should care because the exposure is concentrated in organizations that publish SambaBox interfaces beyond a trusted management network, and there is currently no vendor patch to fall back on, making exposure reduction and credential hygiene the only near-term defenses.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict SambaBox appliance interfaces to a trusted management network or VPN and remove any internet or broad-LAN exposure; disable or tightly audit all low-privileged and shared accounts, enforcing unique credentials and MFA where supported; apply least-privilege roles and remove unnecessary accounts; place the appliance behind network segmentation and monitor for anomalous shell metacharacter input or unexpected command execution by the appliance service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB