Published : Aug. 12, 2026, 11:17 p.m. | 54 minutes ago
Description :UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-49481
N/A
This vulnerability affects the CloudNativeCache (CNC) Framework, specifically versions prior to 2.8.0. It is an insecure deserialization vulnerability (CWE-502) residing in the framework's data replication and inter-node communication protocols. An attacker can craft a specially malformed serialized object that, when processed by a vulnerable CNC node, can lead to arbitrary code execution on the underlying host. This can result in full system compromise, data exfiltration, or denial of service. The vulnerability is exploitable when untrusted data, even from seemingly internal sources, is introduced into the cache cluster or via direct interaction with the CNC API endpoints that handle object deserialization.
1. IMMEDIATE ACTIONS
a. Isolate Affected Systems: Immediately quarantine or restrict network access to all CloudNativeCache (CNC) nodes running vulnerable