EUVD-2026-71086
GHSA-f2hc-mh59-36hc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web interface requires low-privilege auth; file read-only impact means C:H but I:N and A:N, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.
AnalysisAI
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid GFI Exinda AI account at the Unprivileged (lowest-level) role - unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately captures network-reachable, low-complexity exploitation requiring only a low-privilege account, with high confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GFI Exinda AI to version 7.6.5 or later, as documented at https://gfi.ai/products-and-solutions/network-management-solutions/exinda-networkorchestrator/resources/documentation/product-releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running GFI Exinda AI versions prior to 7.6.5 and document current user account inventory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gfi Exinda Ai
View allArbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagno
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the unde
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today