Spug (<= 3.4.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/spug--3.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 13 Sep 2026 11:26:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in Spug via Command Injectionhttps://feed.craftedsignal.io/briefs/2026-09-spug-rce/Sun, 13 Sep 2026 11:26:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-spug-rce/Spug versions 3.4.0 and earlier are vulnerable to authenticated remote code execution due to improper shell command validation in the ping_check function.Spug, an open-source server management platform, contains a critical remote code execution vulnerability (CVE-2026-90770) in the ping_check function. The application fails to properly sanitize user-supplied monitor addresses before passing them into shell commands. This vulnerability allows an authenticated attacker possessing monitor-level permissions to trigger command injection by supplying shell metacharacters through the /monitor/run_test/ endpoint. Successful exploitation results in arbitrary code execution with the privileges of the Spug process user. Given the administrative nature of the application, this vulnerability poses a significant risk for lateral movement and full system compromise within the server environments where Spug is deployed.

Impact

Successful exploitation of CVE-2026-90770 allows an authenticated attacker to execute arbitrary commands on the underlying host. This can lead to unauthorized access to server configurations, credential theft, and full system takeover. Organizations utilizing Spug for server management are at high risk if they have allowed untrusted or compromised accounts to hold monitor-level permissions.

Recommendation

Prioritize the immediate upgrade of all Spug instances to a version released after 3.4.0 that addresses CVE-2026-90770. Monitor web server logs for suspicious requests to the /monitor/run_test/ endpoint that contain shell metacharacters such as semicolons, pipes, or command substitution sequences. Restrict access to the monitoring and administrative modules of the Spug application to trusted personnel only until the software is updated.

]]>highadvisorywebserverrcecommand-injection