CVE-2026-108682: zhayujie CowAgent Web Console upload read denial of service
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
CowAgent versions up to and including 2.1.6 are identified as affected, specifically the Web Console's handling of reads from the /upload file path.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely over the network and has low attack complexity, but it requires low-level privileges. No user interaction is required.
Is exploit code available?
Yes. The exploit has been made publicly available, increasing the likelihood that the issue could be used in attacks.
What is the impact of successful exploitation?
Successful exploitation can cause denial of service. The supplied severity vector also indicates low integrity and availability impact, with no confidentiality impact.
Is a vendor fix available?
The provided information does not identify a fix or mitigation. It states that the vendor was contacted early about the disclosure but did not respond.