EUVD-2026-76991
GHSA-h5c4-vc34-6jcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low complexity; PR:L because monitor-role authentication is required; no scope change as execution stays within Spug process boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.
AnalysisAI
Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the /monitor/run_test/ HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with subprocess.run(..., shell=True). Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid Spug account with monitor-role permissions, specifically the ability to access the `/monitor/run_test/` endpoint - this is a RBAC-controlled permission, not available to all authenticated users by default; (2) network access to the Spug API server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly characterizes this as a low-complexity, network-reachable vulnerability whose sole meaningful barrier is possession of a valid Spug account with monitor permissions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream patch commit 97aebf133e1f9cbb35ccebadab1faedfdfe93f42 from the openspug/spug GitHub repository; a tagged patched release version was not independently confirmed from the available data, so deployments should verify whether a release has been cut post-patch by checking https://github.com/openspug/spug/releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Spug deployments and document current versions; immediately restrict network access to the /monitor/run_test/ endpoint via firewall, proxy, or WAF rules, limiting it to trusted administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today