CVE-2026-67827

Summary

The flaw allows remote attackers to execute arbitrary shell commands via the setServerConfig API endpoint, leading to Remote Code Execution (RCE). This is critical because it can be exploited without authentication, providing full control over the system.

Exploitability

Exploitation is relatively easy due to the unauthenticated access required. Attackers need to send a request to the setServerConfig API with a malicious payload.

Blast radius

If exploited, this flaw could result in complete system compromise, allowing attackers to execute arbitrary commands and potentially gain full control over the server running ZLMediaKit.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the setServerConfig API endpoint or restrict access to it to authenticated users only. If a fixed version is available, upgrade to the latest version: 'Upgrade to the latest version of ZLMediaKit that includes the fix for CVE-2026-67827'.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.