CERT-FR Advisory: Critical RCE Vulnerabilities in Belden macmon and NRSW
The French CERT-FR published advisory CERTFR-2026-AVI-1438 warning of multiple vulnerabilities in Belden macmon and NRSW that allow an attacker to achieve remote arbitrary code execution. Affected products include NRSW versions prior to 5.0.0.104 and macmon versions 6.x and 7.x without the latest security patch; Belden notes that 6.x installations must first be upgraded to 7.x before the patch can be applied. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and were disclosed in Belden's PSIRT bulletin of 22 October 2026, following an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued 21 October 2026.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1438 reports multiple vulnerabilities in Belden macmon and NRSW that let an attacker execute arbitrary code remotely. They are tracked as CVE-2026-109618 and CVE-2026-109619. The sources do not describe each CVE separately, nor the exact network reach, authentication or user interaction required. The title of Belden's bulletin refers to critical PHP vulnerabilities. Affected: NRSW versions before 5.0.0.104, and macmon 6.x and 7.x without the latest security patch. Belden says 6.x installations must first be upgraded to 7.x before the patch can be applied.
Como foi descoberta
The articles do not say who found the flaws or how. Belden published its PSIRT bulletin (PSIRT-10-Critical-PHP-Vulnerabilities-in-macmon-and-NRSW) on 22 October 2026, a day after CERT-FR issued alert CERTFR-2026-ALE-014 on 21 October 2026. CERT-FR then published advisory CERTFR-2026-AVI-1438, pointing to the vendor bulletin for the patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:22.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- Impact: remote arbitrary code execution.
- Affected: NRSW < 5.0.0.104; macmon 6.x/7.x without the latest security correction.
- CVE-2026-109618 and CVE-2026-109619.
Remediação
- Apply the patches referenced in Belden's official security bulletin.
- Upgrade macmon 6.x installations to 7.x before applying the latest patch.
Linha do tempo
-
CERT-FR Advisory: Critical RCE Vulnerabilities in Belden macmon and NRSW
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1438 warning of multiple vulnerabilities in Belden macmon and NRSW that allow an attacker to achieve remote arbitrary code execution. Affected products include NRSW versions prior to 5.0.0.104 and macmon versions 6.x and 7.x without the latest security patch; Belden notes that 6.x installations must first be upgraded to 7.x before the patch can be applied. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and were disclosed in Belden's PSIRT bulletin of 22 October 2026, following an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued 21 October 2026.
Technical Details
- Impact: remote arbitrary code execution.
- Affected: NRSW < 5.0.0.104; macmon 6.x/7.x without the latest security correction.
- CVE-2026-109618 and CVE-2026-109619.
Remediation
- Apply the patches referenced in Belden's official security bulletin.
- Upgrade macmon 6.x installations to 7.x before applying the latest patch.