EUVD-2026-63794
GHSA-m936-qf8f-hcvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with low complexity but requires administrator authentication (PR:H); root command execution crosses the app/OS boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (ZUSO ART).
CVSS VectorVendor: ZUSO ART
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
AnalysisAI
OS command injection in the Datiphy Data Management Center API endpoint (versions v8.3.0 through v8.5.1) lets an authenticated administrator run arbitrary operating-system commands as root, escalating application-level admin rights into full host compromise. Rated CVSS 4.0 9.4 (Critical) and reported by ZUSO ART, the flaw yields high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrator authentication to the Datiphy Data Management Center (CVSS PR:H) and network reachability to the vulnerable API endpoint on an instance running v8.3.0 through v8.5.1; no user interaction and no special client-side conditions are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority within environments that run this product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or abused administrator credentials - through phishing, credential reuse, or a malicious insider - sends a crafted request to the vulnerable API endpoint of a reachable Data Management Center instance. The injected shell metacharacters cause the appliance to execute attacker-chosen commands as root, giving full control of the host and the sensitive database-audit data it manages. … |
| Remediation | No vendor-released patch version is identified in the available data, so a concrete upgrade target cannot be cited; consult the ZUSO advisory at https://zuso.ai/advisory and Datiphy vendor support to obtain a fixed release above v8.5.1 and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Datiphy v8.3.0 through v8.5.1 and document administrative account holders with API access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Data Management Center
View allArbitrary file write in Datiphy Data Management Center versions 8.3.0 through 8.5.1 lets a remote, unauthenticated attac
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log int
Unauthenticated arbitrary file upload in Datiphy Data Management Center v8.3.0 through v8.5.1 exposes the upload API end
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today