BEHNKE-SA-2026-0001
Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
All Behnke ControlCenter up to version 1.0.497435 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.
Ce texte n'existe pas en français – la version en anglais est affichée.
Produits concernés
- Behnke ControlCenter — concerné : 1.0.494577, 1.0.494723, 1.0.497435, 1.0.491941 · corrigé dans : 1.0.497965
Description
All Behnke ControlCenter up to version 1.0.497435 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.
Public proof-of-concept exploits exist, and exploitation attempts against internet-facing PHP installations have been reported. We are not aware of any exploitation of the Behnke ControlCenter at the time of publication.
Remedy
Update to version 1.0.497965 or later. Until then, do not expose the web interface to the internet.
Historique
- Publié