Authenticated command execution via exposed service calls
Published Feb 27, 2023 · Updated Mar 11, 2025
OS command injection in Sme.UP ERP TOKYO V6R1M220406 allows remote authenticated users to execute operating system commands. The Loocup component accepts crafted calls to the /debug and /XMLService endpoints that pass attacker-controlled function input to backend system-command execution. A valid connection code or AS/400 password is required, and commands run with the application process's privileges, enabling shell access or malware execution.
Summary
What happened
OS command injection in Sme.UP ERP TOKYO V6R1M220406 allows remote authenticated users to execute operating system commands. The Loocup component accepts crafted calls to the /debug and /XMLService endpoints that pass attacker-controlled function input to backend system-command execution. A valid connection code or AS/400 password is required, and commands run with the application process's privileges, enabling shell access or malware execution.
The record
- CVE
- CVE-2023-26759
- Published
- Feb 27, 2023
- Updated
- Mar 11, 2025
- Vendor
- Unknown vendor
- Product
- Unknown product
- Classifications
- CWE-78, T1059
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Feb 27, 2023CVE publishedPublication date reported by the CVE source.
- Mar 11, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
What conditions does exploitation require?
What is affected?
Affected products and versions are unavailable in this record.
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Tinexta Cyber command-injection proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo