EUVD-2026-89475
GHSA-hxwh-85p6-wm8w
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent, high-complexity, and authenticated (AV:A/AC:H/PR:L) per vendor vector; only limited confidentiality and integrity impact and no availability effect, consistent with a low-severity eval-injection hardening issue.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
AnalysisAI
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-class) functions in Toptech TMS7 and Toptech TopHat terminal-management deployments, achieving limited code injection with Low confidentiality and integrity impact and no availability effect. The issue is scored 2.1 under CVSS 4.0 and was independently assessed as AV:A/AC:H/PR:L/UI:N with Low C/I, so it sits firmly in the low-priority tier despite its CWE-95 code-injection classification: it is not reachable from the internet by default, requires valid low-privilege credentials, and demands high attack complexity to land the crafted input on the evaluator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker with adjacent-network access (AV:A) to a Toptech TMS7 or TopHat deployment AND valid low-level authentication (PR:L), and involves high attack complexity (AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority issue despite the CWE-95 (code injection) classification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Toptech's security release announcement for TMS7 version 7.8 (https://www.toptech.com/blog/tms7-version-7-8-strengthens-security) is the indicated remediation path, and the exact fix build should be confirmed with Toptech before upgrading; apply the same vendor guidance to TopHat installations, coordinating timing per CISA ICS Advisory ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02, CSAF copy at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json) and validating backups plus a rollback plan before touching production OT hosts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech S
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and ea
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) all
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Same weakness CWE-95 – Eval Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today