Netforensicmcp
Monthly
Remote command injection in kylecui NetForensicMCP 2.1.0 allows authenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the `interface` or `protocol` arguments passed to the `execAsync` function in `index.js`. A public proof-of-concept exists via a GitHub issue, though this vulnerability is not currently listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality, integrity, and availability impact with no lateral scope change, but the public exploit and absent vendor response elevate practical urgency for any deployment.
Remote command injection in kylecui NetForensicMCP 2.1.0 allows authenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the `interface` or `protocol` arguments passed to the `execAsync` function in `index.js`. A public proof-of-concept exists via a GitHub issue, though this vulnerability is not currently listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality, integrity, and availability impact with no lateral scope change, but the public exploit and absent vendor response elevate practical urgency for any deployment.