CVE-2026-33277

OS Command Injection in LogonTracer Prior to v2.0.0 Allows Arbitrary Command Execution by Authenticated User

View on CVE.org
Published Apr 27, 2026 CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Description
An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.

Analysis

AI-generated

Technical impact

An OS command injection vulnerability exists in LogonTracer before version 2.0.0, allowing any logged‑in user to execute arbitrary operating‑system commands. This flaw, catalogued as CWE‑78, gives an attacker the potential to compromise system confidentiality, integrity, and availability at the level of the authenticated user.

Affected Systems

Any deployment of LogonTracer that is not updated to version 2.0.0 or newer is affected. This includes all versions prior to 2.0.0 as identified by JPCERT/CC.

Risk and Exploitability

The CVSS score of 8.7 marks this vulnerability as high severity. The EPSS score is reported as less than 1%, indicating low current exploitation probability, and it is not listed in the CISA KEV catalog. The weakness can be exploited by a logged‑in user; no remote exploitation path is documented in the description.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade LogonTracer to version 2.0.0 or newer as released by the vendor.
  • Restrict LogonTracer access to only trusted users and limit roles that can log in if an immediate upgrade is not feasible.
  • Monitor system logs for anomalous command execution and audit logged user activity for signs of abuse.

Generated by OpenCVE AI on April 28, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Jpcert
Jpcert logontracer
CPEs cpe:2.3:a:jpcert:logontracer:*:*:*:*:*:*:*:*
Vendors & Products Jpcert
Jpcert logontracer
Type Values Removed Values Added
Title OS Command Injection in LogonTracer Prior to v2.0.0 Allows Arbitrary Command Execution by Authenticated User
Type Values Removed Values Added
First Time appeared Japan Computer Emergency Response Team Coordination Center (jpcert/cc)
Japan Computer Emergency Response Team Coordination Center (jpcert/cc) logontracer
Vendors & Products Japan Computer Emergency Response Team Coordination Center (jpcert/cc)
Japan Computer Emergency Response Team Coordination Center (jpcert/cc) logontracer
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.
Weaknesses CWE-78
References
Metrics cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
jpcert
Published
Updated
Apr 27, 2026, 3:32 PM
Reserved
Apr 21, 2026, 11:51 PM

View source JSON

Updated
Apr 27, 2026, 3:31 PM

JSON

Status
Analyzed
Published
Apr 27, 2026, 12:16 AM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
Apr 28, 2026, 5:00 AM

JSON