EUVD-2026-64706
GHSA-5jrp-qhfh-7jjg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable test page passes input to the OS shell (AV:N/AC:L/PR:N/UI:N), yielding full RCE and thus high C/I/A on an unchanged scope.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.
AnalysisAI
OS command injection in 4MOSAn GCB Doctor allows unauthenticated remote attackers to execute arbitrary system commands via a leftover ADOdb test page whose parameter is passed into a shell context. The vulnerable component is a debug/test artifact (an ADOdb connection test page) that was never removed from production builds, so any internet-reachable instance before build 20260621 is exploitable with a single crafted request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is that the vulnerable, un-removed ADOdb test page ships in the deployed build (any version before 20260621) and is reachable over the network; the attacker sends a crafted value in the specific test-page parameter that is passed to an OS command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine high priority rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for internet-exposed 4MOSAn GCB Doctor instances and requests the leftover ADOdb test page, supplying a parameter value containing an OS command separator followed by their payload (for example a reverse shell or reconnaissance command). Because the endpoint requires no authentication and the parameter is passed to the OS shell, the command executes on the server with the privileges of the web application, giving the attacker a foothold in a single unauthenticated request. … |
| Remediation | Patch available per vendor advisory: upgrade 4MOSAn GCB Doctor to build 20260621 or later, which is the first fixed version according to the EUVD range (fixed at 20260621). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all 4MOSAn GCB Doctor deployments to identify versions and network exposure; isolate any pre-20260621 internet-reachable instances or restrict inbound access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today