CVE-2024-26260: Hgiga OAKlouds - Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-15 · updated 2026-06-17
Weakness: CWE-78

Description

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

Affected products

HGiga Oaklouds-Organization-2.0: before 188 — fixed in 188
HGiga Oaklouds-Organization-3.0: before 188 — fixed in 188
HGiga Oaklouds-Webbase-2.0: before 1051 — fixed in 1051
HGiga Oaklouds-Webbase-3.0: before 1051 — fixed in 1051

How to fix

Upgrade to a fixed version: HGiga Oaklouds-Organization-2.0 188; HGiga Oaklouds-Organization-3.0 188; HGiga Oaklouds-Webbase-2.0 1051; HGiga Oaklouds-Webbase-3.0 1051. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-26260 or the next vulnerability affects your stack