CVE-2026-12104CWE-78

Authenticated OS Command Injection in Bondix

High · published June 19, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber
EPSS
0.01316 · 70.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-19T13:41Z
EPSS history
Timeline
  • 19 JUN 13:41Z
    Authenticated OS Command Injection in Bondix
    cvelistv5