CVE-2026-15027: Changing｜CGServiSign - OS Command Injection
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux NHIServisignto a version that resolves this vulnerability.Fixed in 1.0.26.0625
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the CGServiSign local service are exposed if they can be induced to visit a malicious web page. The attacker does not need to authenticate to the service.
What does an attacker need to exploit it?
An attacker needs to persuade a victim to visit a malicious web page. Exploitation is remote and requires user interaction, but no attacker privileges or authentication are required.
What is the potential impact of successful exploitation?
Successful exploitation allows arbitrary operating-system commands to be injected through the local service interface and executed on the victim's local computer. This can affect confidentiality, integrity, and availability.