CVE-2026-40456CWE-78

OS Command Injection in LMS

High · published June 18, 2026

CVSS v4.0
8.6
EPSS
3%
Percentile
86.3
In the wild
Unconfirmed
What it is

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
EPSS
0.02792 · 86.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-18T10:58Z
EPSS history
Timeline
  • 18 JUN 10:58Z
    OS Command Injection in LMS
    cvelistv5