Dashboard / CVE-2026-12104

CVE-2026-12104

HIGH
MEDIUM Priority: 0.11 BB Relevance: 62/100
Published: 2026-06-19 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

Weakness Classification (1)

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

EPSS — Exploitation Probability

1.32%
Raw Score 0.013160
Percentile 70.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01316
2026-10-28
0.01316

Intelligence Sources

nvd ref →

External Links