Vulnerability · Published Feb 19, 2026 · Assigned by VulDB
CVE-2026-2686SECCN Dingcheng G10 session_login.cgi qq os command injection
Critical 9.8
In plain English
A critical-severity OS command injection in G10 from SECCN Dingcheng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.6%top 14.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SECCN Dingcheng | G10 | 3.1.0.181203 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R
References
- VDB-346488 | SECCN Dingcheng G10 session_login.cgi qq os command injection vdb-entry, technical-description
- VDB-346488 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #754200 | SECCN SECCN G10 VPN V3.1.0.181203 Unauthorized RCE third-party-advisory
- https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md related
- https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md#2-vulnerability-reproduction-proof-of-concept exploit