CVE-2026-6349 | The iSherlock developed by HGiga has an OS Command Injecti… | CVSS 9.8 CRITICAL

Description

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

Metadata

CVE ID: CVE-2026-6349
State: PUBLISHED
Assigner: twcert
Reserved: 2026-04-15 11:32 UTC
Published: 2026-04-16 02:24 UTC
Last updated: 2026-04-24 07:23 UTC
Primary CWE: CWE-78
CWE-78 Improper neutralization of special elements used in a…
Vendor / Product: HGiga / iSherlock-base-4.5
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (4)

Vendor	Product	Platform	Versions
HGiga	iSherlock-audit-4.5	—	0 < 261
HGiga	iSherlock-audit-5.5	—	0 < 261
HGiga	iSherlock-base-4.5	—	0 < 476
HGiga	iSherlock-base-5.5	—	0 < 476

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)