CVE-2026-28517
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
Vexday Risk Score
63High priority
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 9.3EPSS 5.6%KEV nãoPoC públicaNuclei —Metasploit simPatch —
Lifecycle
27 Feb 2026Published on NVD
28 Feb 2026Metasploit module available
Recommendation: Plan a near-term fix — a public PoC already exists.
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
openDCIM · openDCIMpublic PoCs found — 2
cve_referencechocapikk.com/posts/2026/opendcim-sqli-to-rce/unverifiedcve_referencegithub.com/Chocapikk/opendcim-exploitunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/https://github.com/Chocapikk/opendcim-exploithttps://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L467https://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L7https://github.com/opendcim/openDCIM/pull/1664https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter