Which versions of Bondix Server are affected by EUVD-2026-38031?

SIMA GmbH Bondix Server versions up to 1.25.7.5 contain a command injection vulnerability allowing authenticated users with configuration privileges to execute arbitrary operating system commands on…

How to fix or mitigate EUVD-2026-38031?

Within 24 hours: Inventory all Bondix Server installations including version numbers and identify personnel with configuration write access. Within 7 days: Reduce configuration write privileges to a minimal, documented set of trusted administrators; enable comprehensive audit logging for all configuration changes; deploy detection and alerting for suspicious OS command execution on affected systems. Within 30 days: Request patch availability and timeline from SIMA GmbH; evaluate operational dependency and consider alternative products if remediation timeline is unacceptable; implement network isolation controls to limit lateral movement from compromised Bondix instances.

Bondix Server EUVD-2026-38031

Q: What is the CVSS score of EUVD-2026-38031?

EUVD-2026-38031 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber. EPSS exploitation probability: 1.1%.

| CVE-2026-12104 HIGH

OS Command Injection (CWE-78)

2026-06-19 NCSC.ch

GHSA-9jwh-589c-mpc6

Command Injection Bondix Server

8.6

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N) with no special conditions (AC:L) but requires high-privilege configuration-write access (PR:H); no user interaction, and shell execution yields full host CIA impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:20 vuln.today

CVE Published

Jun 19, 2026 - 13:41 cve.org

HIGH 8.6

DescriptionCVE.org

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

AnalysisAI

Authenticated OS command injection in SIMA GmbH Bondix Server through 1.25.7.5 on Linux allows an attacker with configuration write privileges to execute arbitrary operating-system commands by supplying crafted values in the environment and tunnel configuration that are passed unsanitized to server-side scripts. The flaw was reported by NCSC.ch and carries a CVSS 4.0 base score of 8.6 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Bondix Server is a Linux-based management/orchestration service from SIMA GmbH whose environment and tunnel configuration subsystems accept operator-supplied values that are later interpolated into server-side shell scripts. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning configuration strings reach a shell interpreter without proper escaping or argument-array invocation, so metacharacters such as ';', '|', '$()' or backticks break out of the intended command. The affected CPE is cpe:2.3:a:sima_gmbh:bondix_server:*:*:*:*:*:*:*:* covering all releases up to and including 1.25.7.5.

RemediationAI

Upgrade Bondix Server to the fixed release identified in the vendor advisory at https://wiki.bondix.dev/wiki/Security_Advisories#CVE-2026-12104_%E2%80%94_Authenticated_OS_Command_Injection_in_Bondix and cross-referenced in the release notes at https://wiki.bondix.dev/wiki/Downloads#Release_Notes (exact patched version not enumerated in the provided intelligence - confirm with the vendor changelog before deployment). Until the upgrade is applied, restrict configuration-write privileges to the smallest possible set of trusted administrators, place the management interface behind a VPN or management-only network segment so only vetted operators can reach it, enable multi-factor authentication on administrative accounts, and audit existing environment and tunnel configuration values for suspicious shell metacharacters; these controls reduce exposure but do not eliminate the underlying injection, and tightening admin access may slow legitimate operational workflows.