CVE-2026-12104

Authenticated OS Command Injection in Bondix

CVSS 8.6 HIGHEPSS 1.1%CWE-78

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber

Affected products

SIMA GmbH · Bondix Server

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wiki.bondix.dev/wiki/Downloads#Release_Notes https://wiki.bondix.dev/wiki/Security_Advisories#CVE-2026-12104_%E2%80%94_Authenticated_OS_Command_Injection_in_Bondix