ArmorX Spam EUVD-2026-104815

Exploitation requires an authenticated session with at least low-privilege access to the ArmorX Spam application (CVSS PR:L), reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). The specific injectable parameter is not named in the available data and must be identified from the TWCERT advisory. The key limiting factor is the authentication requirement: an attacker must first obtain or be granted valid credentials, so exposure is driven by how broadly accounts are provisioned and whether the management interface is network-exposed. No special non-default configuration is indicated in the description.

This is a moderate-severity, authenticated command injection flaw (CVSS 4.0 base 7.1) in ArmorX Spam. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - so the attacker must already hold a valid account on the appliance, which meaningfully narrows the attacker population versus an unauthenticated flaw. Impact is scoped to integrity only (VI:H), with no confidentiality or availability impact rated, consistent with the description's focus on uploading/injecting code rather than data theft or disruption - though in practice uploaded malicious code could be leveraged for broader compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent widespread exploitation; this should be treated as a patch-in-normal-cycle item rather than an emergency. One data note: the assigned CWE-93 (Improper Neutralization of CRLF Sequences) does not match the 'Command Injection' description and tag (which map to CWE-77/CWE-78) - verify the true weakness class with the vendor/TWCERT advisory.

An attacker who already possesses valid (low-privilege) credentials to the ArmorX Spam management interface submits a crafted value in a specific parameter that is passed unsanitized to a system command, injecting attacker-controlled commands. This allows them to write/upload malicious code to the server, establishing a foothold for further action. No public exploit code is identified at time of analysis, so exploitation currently requires independent discovery of the vulnerable parameter.