EUVD-2026-39163
GHSA-jpr4-h957-w6xg
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
OS command injection in Rapid7's InsightConnect Tcpdump Plugin (versions before 2.0.0) on Linux lets an authenticated attacker run arbitrary operating-system commands by injecting shell metacharacters into the 'options' or 'filter' parameters, which are unsafely concatenated into a tcpdump shell invocation. An attacker holding low-privileged access to a SOAR workflow that uses this plugin can fully compromise the orchestrator host (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; EPSS is modest at 0.73%.
Earlier versions of this analysis (2)
OS command injection in Rapid7 InsightConnect's Tcpdump Plugin (versions prior to 2.0.0) on Linux lets authenticated users inject arbitrary shell commands through the 'options' or 'filter' parameters, which are concatenated unsanitized into a shell invocation of tcpdump. Successful exploitation yields full code execution in the plugin's container context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS sits at a modest 0.73% (50th percentile), and CISA SSVC marks exploitation status as none.
OS command injection in the Rapid7 InsightConnect Tcpdump Plugin on Linux enables authenticated, high-privileged attackers to execute arbitrary OS commands on the underlying host by supplying unsanitized input to the options or filter parameters during plugin invocation. The vulnerability stems from insufficient input sanitization when constructing shell commands that invoke tcpdump. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, reducing immediate urgency, though the PR:H requirement limits the realistic attacker population to those with existing high-level access to the InsightConnect platform.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Insightconnect Tcpdump Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated plugin operator (PR:L) supplies parameters over the network (AV:N) with low complexity and no interaction; command injection yields full host compromise (C:H/I:H/A:H).
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction.
Executive ViewAI
Rapid7 InsightConnect Tcpdump Plugin versions before 2.0.0 contain an OS command injection flaw that allows authenticated low-privileged users to execute arbitrary commands on the orchestrator host. A compromised SOAR platform can be leveraged to automate attacks across integrated systems and access sensitive credentials stored for incident response automation, creating lateral movement risk across the organization's security infrastructure.
Within 24 hours: audit all InsightConnect deployments to identify Tcpdump Plugin versions and restrict low-privilege workflow creation permissions. Within 7 days: upgrade Tcpdump Plugin to version 2.0.0 or later after testing in non-production. Within 30 days: verify all production instances are patched, review access logs for workflow modifications, and implement multi-factor authentication or IP restrictions for administrative access to InsightConnect.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB