BEHNKE-SA-2026-0001
Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
All Behnke ControlCenter up to version 1.0.497435 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.
Diesen Text gibt es nicht auf Deutsch – angezeigt wird die Fassung auf Englisch.
Betroffene Produkte
- Behnke ControlCenter — betroffen: 1.0.494577, 1.0.494723, 1.0.497435, 1.0.491941 · behoben in: 1.0.497965
Beschreibung
All Behnke ControlCenter up to version 1.0.497435 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.
Public proof-of-concept exploits exist, and exploitation attempts against internet-facing PHP installations have been reported. We are not aware of any exploitation of the Behnke ControlCenter at the time of publication.
Remedy
Update to version 1.0.497965 or later. Until then, do not expose the web interface to the internet.
Verlauf
- Veröffentlicht