PublicCMS EUVD-2026-30687

Network access to PublicCMS installation required. No authentication required (CVSS PR:N). No user interaction needed (CVSS UI:N). The vulnerability is exploitable against default configurations of PublicCMS 5.202506.d where the SafeConfigComponent is active and accessible through network-facing endpoints. Exploitation does NOT require: administrative privileges, specific feature enablement beyond standard PublicCMS deployment, or social engineering. The low attack complexity (AC:L) indicates no race conditions, timing dependencies, or complex prerequisite steps. Limiting factors: impact restricted to integrity violations only (no confidentiality breach or availability disruption per CVSS VC:N/VA:N), suggesting the hard-coded key protects only specific data validation or signature operations rather than core authentication or encryption systems.

The CVSS 5.5 (Medium) score reflects limited direct impact (only integrity affected at low level), but the real-world risk profile is elevated by several factors. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable attack conditions - remote unauthenticated access with no user interaction required. The E:P (Proof-of-concept) metric confirms public exploit availability, validated by VulDB references including a detailed exploit writeup at vulnplus-note.wetolink.com. However, the impact limitation (VI:L with VC:N/VA:N) suggests the hard-coded key enables only partial data manipulation, not full system compromise. Absence from CISA KEV indicates no confirmed mass exploitation, and the vendor's non-response to disclosure suggests this may be abandoned or minimally supported software. SSVC decision context: Exploitation is automatable (network vector, no auth), technical impact limited to partial data integrity, exploitation status is POC-available but not confirmed active. Priority depends on deployment exposure - internet-facing PublicCMS installations face immediate risk, while internal deployments have reduced attack surface. Critical uncertainty: The description states 'VI:L' but does not clarify what data integrity protections the hard-coded key bypasses - could range from file upload validation to cryptographic signatures on sensitive operations. Defenders should verify actual impact scope before prioritizing remediation.

An unauthenticated attacker identifies a PublicCMS 5.202506.d installation through fingerprinting or Shodan reconnaissance. Using the publicly available exploit code from vulnplus-note.wetolink.com, the attacker crafts HTTP requests targeting the SafeConfigComponent's getSignKey function with manipulated privatefile_key arguments. Because the cryptographic key is hard-coded, the attacker can predict or extract the key value through static analysis of the Java bytecode or published exploit details. With knowledge of the hard-coded key, the attacker bypasses integrity protections that rely on this key, potentially forging cryptographic signatures, manipulating file validation tokens, or altering data protected by the weak key material. The CVSS vector confirms this requires no authentication, no user interaction, and presents low attack complexity, making exploitation accessible to moderately skilled attackers with standard web testing tools.