CVE-2026-5131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5131", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-03-30T09:39:43.884Z", "datePublished": "2026-04-17T10:45:34.021Z", "dateUpdated": "2026-04-17T11:45:23.719Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GREENmod", "vendor": "Nomios Poland", "versions": [{"lessThan": "2.8.33", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Ressel"}], "datePublic": "2026-04-17T12:24:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. <span style=\"background-color: rgba(221, 223, 228, 0.1);\">This allows for Server-Side Request Forgery to&nbsp;</span>any Windows system&nbsp;on which the agent is installed and which provides communication via SMB or WebDav.<br><br>This issue was fixed in version 2.8.33."}], "value": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-17T10:45:34.021Z"}, "references": [{"tags": ["product"], "url": "https://www.nomios.pl/greenmod/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2026/04/CVE-2026-5131"}], "source": {"discovery": "EXTERNAL"}, "title": "Server-Side Request Forgery in GREENmod", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T11:44:55.994641Z", "id": "CVE-2026-5131", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T11:45:23.719Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T11:44:55.994641Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T11:45:14.103Z"}}], "cna": {"title": "Server-Side Request Forgery in GREENmod", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Marcin Ressel"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Nomios Poland", "product": "GREENmod", "versions": [{"status": "affected", "version": "0", "lessThan": "2.8.33", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-17T12:24:00.000Z", "references": [{"url": "https://www.nomios.pl/greenmod/", "tags": ["product"]}, {"url": "https://cert.pl/posts/2026/04/CVE-2026-5131", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33.", "supportingMedia": [{"type": "text/html", "value": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. <span style=\"background-color: rgba(221, 223, 228, 0.1);\">This allows for Server-Side Request Forgery to&nbsp;</span>any Windows system&nbsp;on which the agent is installed and which provides communication via SMB or WebDav.<br><br>This issue was fixed in version 2.8.33.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-17T10:45:34.021Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5131", "state": "PUBLISHED", "dateUpdated": "2026-04-17T11:45:23.719Z", "dateReserved": "2026-03-30T09:39:43.884Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-17T10:45:34.021Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GREENmod", "vendor": "Nomios Poland", "versions": [{"lessThan": "2.8.33", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33."}, {"lang": "es", "value": "GREENmod utiliza tuber\u00edas con nombre para la comunicaci\u00f3n entre los plugins, el portal web y el servicio del sistema, pero las listas de control de acceso para estas tuber\u00edas est\u00e1n configuradas incorrectamente. Esto permite a un atacante comunicarse con el flujo y cargar cualquier archivo XML o JSON, que ser\u00e1 procesado por la tuber\u00eda con nombre con los privilegios del usuario bajo cuyo contexto se est\u00e1 ejecutando el servicio. Esto permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor a cualquier sistema Windows en el que el agente est\u00e9 instalado y que proporcione comunicaci\u00f3n a trav\u00e9s de SMB o WebDav.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 2.8.33."}], "id": "CVE-2026-5131", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5131", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T11:44:55.994641Z", "version": "2.0.3"}}]}, "published": "2026-04-17T11:16:11.000", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/04/CVE-2026-5131"}, {"source": "cvd@cert.pl", "url": "https://www.nomios.pl/greenmod/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.8.33)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GREENmod", "source": "cna", "vendor": "Nomios Poland"}, "product": "greenmod", "vendor": "nomios_poland"}], "analysis": {"en": {"generated_at": "2026-04-18T09:23:49.048734+00:00", "value": {"mitigation_remediation": ["Upgrade GREENmod to version 2.8.33 or later to receive the fix for the named pipe ACL misconfiguration.", "Ensure the GREENmod service runs under a least\u2011privilege account and verify that the named pipe access control lists allow only intended users and processes.", "Configure firewall or interface restrictions to block unsolicited SMB and WebDAV traffic from the agent, and monitor for unexpected outbound requests originating from the GREENmod service."], "summary": {"action": "Immediate Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Nomios Poland provides the GREENmod product. Versions prior to 2.8.33 are affected; the issue was fixed in version 2.8.33.", "description_and_impact": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service. The access control lists for these pipes are incorrectly configured, allowing an attacker to send arbitrary XML or JSON data through the pipe. The data is then processed with the privileges of the user under whose context the service runs, giving the attacker the ability to perform server\u2011side request forgery to any Windows system on which the agent is installed and which offers SMB or WebDAV interfaces.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the probability of exploitation is unknown; the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker interacting with the web portal or a plugin to send data to the misconfigured pipe, after which the agent can contact internal or external Windows systems via SMB or WebDAV. If exploited, the attacker could propagate to internal network resources and potentially achieve further privilege escalation."}}}}, "created": "2026-04-17T20:35:22.367508+00:00", "updated": "2026-04-18T09:30:25.688892+00:00", "vendors": ["nomios_poland", "nomios_poland$PRODUCT$greenmod"]}