CVE-2026-5756 (GCVE-0-2026-5756)

Vulnerability from cvelistv5 – Published: 2026-04-14 17:51 – Updated: 2026-04-23 13:33
VLAI
Title
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)
Summary
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T11:55:49.509703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T12:05:46.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-23T13:33:37.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/748485"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Central Office Services - Content Hosting Component",
          "vendor": "Data Recognition Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "975"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server\u0027s configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-14T17:51:53.628Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://www.datarecognitioncorp.com/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)",
      "x_generator": {
        "engine": "VINCE 3.0.35",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5756"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-5756",
    "datePublished": "2026-04-14T17:51:53.628Z",
    "dateReserved": "2026-04-07T16:42:45.597Z",
    "dateUpdated": "2026-04-23T13:33:37.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5756",
      "date": "2026-07-25",
      "epss": "0.00329",
      "percentile": "0.25349"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5756\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2026-04-14T18:17:39.600\",\"lastModified\":\"2026-07-24T09:10:00.153\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server\u0027s configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de modificaci\u00f3n de archivo de configuraci\u00f3n no autenticada en DRC Central Office Services (COS) permite a un atacante modificar el archivo de configuraci\u00f3n del servidor, lo que podr\u00eda llevar a exfiltraci\u00f3n masiva de datos, intercepci\u00f3n de tr\u00e1fico malicioso o interrupci\u00f3n de los servicios de pruebas.\"}],\"affected\":[{\"source\":\"cret@cert.org\",\"affectedData\":[{\"vendor\":\"Data Recognition Corporation\",\"product\":\"Central Office Services - Content Hosting Component\",\"versions\":[{\"version\":\"975\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-16T11:55:49.509703Z\",\"id\":\"CVE-2026-5756\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://www.datarecognitioncorp.com/\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.kb.cert.org/vuls/id/748485\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-16T13:22:44+00:00",
      "cve": "CVE-2026-5756",
      "id": "CVE-2026-5756",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5756.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.kb.cert.org/vuls/id/748485\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-04-23T13:33:37.216Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5756\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-16T11:55:49.509703Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-16T11:55:45.355Z\"}}], \"cna\": {\"title\": \"Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Data Recognition Corporation\", \"product\": \"Central Office Services - Content Hosting Component\", \"versions\": [{\"status\": \"affected\", \"version\": \"975\"}]}], \"references\": [{\"url\": \"https://www.datarecognitioncorp.com/\"}], \"x_generator\": {\"env\": \"prod\", \"engine\": \"VINCE 3.0.35\", \"origin\": \"https://cveawg.mitre.org/api/cve/CVE-2026-5756\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server\u0027s configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-306 Missing Authentication for Critical Function\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"shortName\": \"certcc\", \"dateUpdated\": \"2026-04-14T17:51:53.628Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5756\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-23T13:33:37.216Z\", \"dateReserved\": \"2026-04-07T16:42:45.597Z\", \"assignerOrgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"datePublished\": \"2026-04-14T17:51:53.628Z\", \"assignerShortName\": \"certcc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.