CVE-2026-28517
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
Description
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitation Context
as of October 14, 2026- Its current EPSS score (9.2%) is higher than that of 25% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| openDCIM | openDCIM openDCIM | 0 to 23.04 |
References
7 LinksRecord Details
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.