EUVD-2026-9098

🗓️ 28 Feb 2026 00:31:02Reported by EUVDType

OpenDCIM 23.04 has OS command injection in report_network_map.php via unvalidated fac_Config.dot configuration value.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-28517	27 Feb 202622:12	–	attackerkb
Circl	CVE-2026-28517	28 Feb 202601:25	–	circl
CNNVD	openDCIM 操作系统命令注入漏洞	27 Feb 202600:00	–	cnnvd
CVE	CVE-2026-28517	27 Feb 202622:12	–	cve
Cvelist	CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter	27 Feb 202622:12	–	cvelist
GithubExploit	Exploit for CVE-2026-28515	27 Feb 202619:37	–	githubexploit
NVD	CVE-2026-28517	27 Feb 202623:16	–	nvd
Positive Technologies	PT-2026-22427	27 Feb 202600:00	–	ptsecurity
Rapid7 Blog	Metasploit Wrap-Up 04/17/2026	17 Apr 202620:35	–	rapid7blog
RedhatCVE	CVE-2026-28517	1 Mar 202601:43	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "8593e955-6cf3-3a8f-b3e9-4e9b278ae18c",
        "vendor": {
          "name": "openDCIM"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "1fb3434b-9465-35cf-b18b-d94f79251fd5",
        "product": {
          "name": "openDCIM"
        },
        "product_version": "0 ≤23.04"
      }
    ]
  }
]

Source	Link
chocapikk	www.chocapikk.com/posts/2026/opendcim-sqli-to-rce/
github	www.github.com/Chocapikk/opendcim-exploit
github	www.github.com/opendcim/openDCIM/pull/1664
github	www.github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09
github	www.github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php
github	www.github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php
vulncheck	www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-28517

28 Feb 2026 00:31Current

6Medium risk

Vulners AI Score6

CVSS 49.3

EPSS0.05648