CVE-2026-90492
Received Received - Intake

OS Command Injection in web_robot via case_name Parameter

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py/web.py. The manipulation of the argument case_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90492
EUVD
EUVD-2026-76934

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
webgjc web_robot From 2.4.0 (inc) to 2.5.0 (exc)
webgjc web_robot From 2.5.0 (inc) to 2.8.0 (exc)
webgjc web_robot 2.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the webgjc web_robot software versions 2.4.0, 2.5.0, and 2.8.0. It exists in the controller_listen and controller_recover functions of the py/web.py file. The issue arises when the case_name argument is manipulated, allowing an attacker to inject and execute arbitrary OS commands remotely.

Detection Guidance

Check if the affected web_robot versions (2.4.0, 2.5.0, 2.8.0) are installed by inspecting the py/web.py file for the controller_listen/controller_recover function. Look for improper input validation in the case_name argument that could allow OS command injection.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected system. This could lead to unauthorized access, data theft, system compromise, or disruption of services. The impact depends on the privileges of the web_robot process and the system configuration.

Compliance Impact

This vulnerability allows remote command injection via the case_name argument in the webgjc web_robot software. Such unauthorized code execution could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy).

Mitigation Strategies

Immediately update or patch the web_robot software to a non-vulnerable version. If no patch is available, disable the affected functions or restrict network access to the vulnerable service. Monitor for unusual command execution patterns in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart