Zenius EMS CVE-2026-88260

Exploitation requires the attacker to be on an adjacent network segment - the same LAN, VLAN, or broadcast domain as the Zenius EMS 8.0 OAM instance (AV:A per the reported CVSS 4.0 vector). No authentication is required (PR:N), and no user interaction is needed (UI:N). The vulnerability is specific to the OAM (Operations, Administration and Maintenance) component of Zenius EMS 8.0 through Build 109. Internet-facing exploitation is only possible if the OAM interface is exposed externally via NAT, misconfigured routing, or an adjacent DMZ zone. The attack chain requires both knowledge of the alternate bypass path and the ability to supply a Remote Code Inclusion payload, which may require prior reconnaissance of the endpoint structure. These adjacency and endpoint-knowledge requirements are the primary limiting factors beyond the raw CVSS metrics.

The CVSS 4.0 score of 8.7 with AV:A/AC:L/AT:N/PR:N/UI:N reflects a high-severity but network-bounded threat - exploitation requires the attacker to be on the same LAN, VLAN, or broadcast domain as the target OAM interface, which materially limits opportunistic internet-scale exploitation. Even a mid-sized municipal IT team in inowroclaw running this OAM platform on an internal management VLAN should treat this as urgent, given the zero-authentication, low-complexity path directly to full code execution. No CISA KEV listing has been observed, no EPSS data is present in the available intelligence, and no public POC has been identified, suggesting this has not been widely weaponized as of analysis time. The sole reference points to the vendor's product features page rather than a dedicated security advisory, leaving patch status and fix version unconfirmed - this is a significant data gap. Real-world risk is further modulated by the niche, regionally concentrated deployment footprint of the product.

An attacker with access to the same internal network segment as a Zenius EMS 8.0 OAM server sends a crafted HTTP request to an endpoint reachable via an alternate authentication bypass path, bypassing the primary login enforcement. The request includes a parameter referencing an attacker-controlled remote resource; the server fetches and executes that resource as code, granting the attacker full control over the system. No public proof-of-concept has been identified, but the low attack complexity (AC:L) and absence of required privileges indicate a functional exploit would require only endpoint enumeration and basic RCI payload crafting.