CVE-2026-110667: cemtan sar2html sar2html.py hard-coded credentials
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRETKEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected software identified in the available data is cemtan sar2html version 4.0.0. The vulnerable functionality is in sar2html.py and involves its SECRET_KEY argument.
Can this be exploited remotely without credentials or user interaction?
Yes. The vulnerability is described as remotely exploitable, with network access, low attack complexity, no privileges required, and no user interaction required.
What is known about remediation status?
The project was notified through an issue report but had not responded at the time of publication. No fixed version or workaround is provided in the available information.