CVE-2026-76761

Deferred Deferred - Pending Action

Command Injection in cc-connect Management API

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: VulDB

Description

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76761

EUVD

EUVD-2026-63165

Affected Vendors & Products

Vendor	Product	Version / Range
chenhg5	cc-connect	to 1.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in chenhg5 cc-connect up to version 1.4.1. It exists in the Management API's shellExecCommand function in core/engine.go. An attacker can manipulate the exec argument to inject and execute arbitrary operating system commands remotely. The issue was reported but closed due to inactivity, and a public exploit is available.

Detection Guidance

This vulnerability involves OS command injection in chenhg5 cc-connect up to 1.4.1 via the Management API. To detect it, inspect network traffic for suspicious API calls to core/engine.go with exec parameters. Check server logs for unexpected command execution patterns or unauthorized system commands.

Impact Analysis

If you use chenhg5 cc-connect up to 1.4.1, an attacker could remotely execute arbitrary commands on your system through the Management API. This could lead to unauthorized data access, system compromise, or further network infiltration. The impact depends on the privileges of the affected service.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited due to inadequate security controls.

Mitigation Strategies

Immediately update chenhg5 cc-connect to a version beyond 1.4.1 to address the OS command injection vulnerability in the Management API. If an update is unavailable, restrict network access to the vulnerable component and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-76761. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70