CVE-2026-121429: fallo de gravedad alta en AzuraCast
AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 1.5%
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
AzuraCast · AzuraCastCVEs relacionadas — AzuraCast
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-100852HIGHAzuraCast before 0.23.8 Command Injection via Streamer UsernameEPSS 4.6%CVE-2026-42605HIGHAzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media UploadEPSS 0.8%CVE-2026-121428HIGHAzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneEPSS 0.7%CVE-2026-42606HIGHAzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassEPSS 0.5%CVE-2026-100856HIGHAzuraCast before 0.23.6 Code Injection via Remote Relay PasswordEPSS 0.5%CVE-2026-100857HIGHAzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolationEPSS 0.4%