{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Conduit AEP",
          "vendor": "Multitech",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in MultiTech\nConduit AEP (models mtcdt / mtcdtip / mtcdtiphp), IoT gateways running mLinux on\nARM 32-bit.\n\nType: authenticated OS command injection (CWE-78) through the uploaded filename\nof the admin-only upload_config command. The management API is served by lighttpd\non TCP 8080 and proxied to the proprietary FastCGI daemon /usr/bin/rcell_api. The\nimport_config handler wraps the client-supplied filename in single quotes to\nbuild import_config \u0027\u003cfilename\u003e\u0027 and runs it through MTS::System::cmd, which\ndisassembly confirms is popen(cmd, \"r\"), that is /bin/sh -c. The multipart parser\nstrips only surrounding double quotes and reduces the value to a basename; single\nquotes are never escaped, so a filename of x\u0027; \u003cCMD\u003e ;# breaks out of the quoting.\n\nScoring. Single base score, not dual-scored:\n- 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. PR:H because\n  command/upload_config is granted only in the administrator permission profile.\n\nImpact: root command execution on a gateway that bridges constrained field devices\nwith IP infrastructure (the daemon runs as uid 0), giving full filesystem read,\nconfiguration rewrite, persistence and pivot. The injected command output is\nredirected rather than echoed, so the injection is blind at the protocol level and\nconfirmation rests on a server-side artefact.\n\nAuthentication: authenticated administrator. No factory default credentials exist;\nthe administrator account is provisioned by the deployer at commissioning. An\nexhaustive review of the unauthenticated surface found no route to this sink\nwithout a valid admin session, so the finding is scoped as post-authentication.\n\nVerification boundary, stated plainly. Verified end to end by emulation only:\nthe root filesystem extracted from the AEP 6.3.6 firmware image was run under\nqemu-arm-static inside a chroot and started through its angel supervisor, with no\nphysical Conduit device used at any point. Against the running daemon in socket\nmode with an admin session established from a non-loopback REMOTE_ADDR, the upload\nreturned {\"code\":200,\"status\":\"success\",\"type\":\"upload\"} and produced a root-owned\nmarker containing uid=0(root) gid=0(root) groups=0(root), while a benign filename\nreturned HTTP 400 and created nothing. AEP 6.3.0 is evidenced by patch diff (the\nimport_config handler is unchanged); the claimed range 6.3.0 through 6.3.6 follows\nfrom that endpoint comparison and the intermediates were not each executed.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/multitech-conduit-import-config-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/77"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/77"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/multitech-conduit-import-config-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/77"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0429",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/77",
            "automated": true,
            "contentSha256": "6a701ee26cc5f333e8fdfe4cc3580f3f8aed7541a3bd50bad3ea64789fc5b3ea",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/77",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:54:58Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0429"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}