Dianping CAT EUVD-2026-70485

Requires network reachability to CAT's web/login endpoint (any deployment ≤3.1.0). The attacker needs no credentials and no user interaction: the cookie checksum is Java String.hashCode() with no server-side key, so a valid admin cookie is forged offline, and the IP-binding control is bypassed by setting the client-controlled x-forwarded-for header to an accepted address. The only real limiting factor is exposure - the CAT console must be reachable by the attacker (internet-facing or reachable from the attacker's network position); there is no default-config safeguard that blocks this once the endpoint is reachable.

This is a genuine high-priority issue rather than an inflated CVSS number. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) is internally consistent with the description: fully remote, no authentication, no user interaction, and complete admin compromise of the monitoring platform. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation is not confirmed active - the risk is driven by exploit simplicity, not observed attacks. The offline-forgeable checksum plus header-controlled IP bypass means exploitation is highly automatable once the cookie format is known, and the vulnerable code is publicly readable, which materially raises the practical likelihood. The main tempering factor is deployment footprint: CAT is a niche APM tool, so exposure is narrower than an internet-scale library. Availability impact (VA:H) is somewhat generous - the primary consequences are confidentiality (config/monitoring data) and integrity (config tampering) - but admin control could plausibly disrupt the monitoring service, so it is defensible.

An attacker who can reach the CAT web console offline computes a session cookie whose String.hashCode()-based checksum validates for an admin identity, then sends the forged cookie with an x-forwarded-for header set to an IP the server accepts. CAT treats the request as an authenticated administrator, granting full configuration access without any credentials. No public POC is noted, but the vulnerable code is open source and the attack requires only standard HTTP tooling.