CVE-2026-90770: Spug through 3.4.0 Remote Code Execution via ping_check

Q: Who can exploit this issue?

An authenticated user with monitor permissions can exploit it. The attack is performed through the /monitor/run_test/ endpoint.

Q: What access or input is required for exploitation?

The attacker must be able to submit a monitor address to the ping_check functionality. Shell metacharacters in that user-supplied address can be injected into the shell command.

Q: What level of access does successful exploitation provide?

Successful exploitation allows arbitrary command execution as the Spug process user. The stated impact includes high confidentiality, integrity, and availability impact.

Q: Which versions are identified as affected?

The provided information identifies Spug through version 3.4.0 as affected.

Published Sep 13, 2026

Updated

Spug through 3.4.0 contains a remote code execution vulnerability in the pingcheck function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/runtest/ endpoint to execute arbitrary commands as the Spug process user.

Affected Software

1 affected component

Spug Spug<=3.4.0

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with monitor permissions can exploit it. The attack is performed through the /monitor/run_test/ endpoint.

What access or input is required for exploitation?

The attacker must be able to submit a monitor address to the ping_check functionality. Shell metacharacters in that user-supplied address can be injected into the shell command.

What level of access does successful exploitation provide?

Successful exploitation allows arbitrary command execution as the Spug process user. The stated impact includes high confidentiality, integrity, and availability impact.

Which versions are identified as affected?

The provided information identifies Spug through version 3.4.0 as affected.

CVE-2026-90770: Spug through 3.4.0 Remote Code Execution via ping_check

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or input is required for exploitation?

What level of access does successful exploitation provide?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or input is required for exploitation?

What level of access does successful exploitation provide?

Which versions are identified as affected?