Description
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Published: 2026-08-19
Score: 6.9 Medium
EPSS: 1.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the shellExecCommand function of chenhg5 cc-connect's Management API. An attacker can manipulate the exec argument to inject operating‑system commands. Successful exploitation allows remote execution of arbitrary commands, compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

This flaw affects all installations of chenhg5 cc-connect up to and including version 1.4.1. The affected product is identified by the cpe:2.3:a:chenhg5:cc-connect. Any environment running the Management API in those versions is at risk.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of 2% indicates a low exploitation probability, and the vulnerability is not listed in CISA KEV. The publicly available exploit shows that the attack can be initiated remotely through the Management API. As the vulnerability is an OS command injection, an attacker can achieve remote code execution with no local privileges.

Generated by OpenCVE AI on August 20, 2026 at 22:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade chenhg5 cc-connect to version 1.4.2 or later when available to eliminate the command injection flaw.
  • Restrict access to the Management API by applying network segmentation or firewall rules, allowing only trusted IP addresses to communicate with it.
  • Implement input validation or sanitization on the exec parameter to block shell metacharacters or enforce a whitelist of allowed commands.
  • Monitor and audit API traffic for suspicious command patterns and promptly investigate abnormal executions.

Generated by OpenCVE AI on August 20, 2026 at 22:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Title chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
First Time appeared Chenhg5
Chenhg5 cc-connect
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:chenhg5:cc-connect:*:*:*:*:*:*:*:*
Vendors & Products Chenhg5
Chenhg5 cc-connect
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Chenhg5 Cc-connect
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T15:14:00.658Z

Reserved: 2026-08-19T16:47:48.806Z

Link: CVE-2026-76761

cve-icon Vulnrichment

Updated: 2026-08-20T15:13:04.724Z

cve-icon NVD

Status : Deferred

Published: 2026-08-19T23:16:18.540

Modified: 2026-08-20T16:18:19.940

Link: CVE-2026-76761

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T22:30:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')