CVE-2026-27476
CRITICALRustFly 2.0.0 - OS Command Injection via UDP Remote Control
Title source: llmDescription
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target system, including reverse shell establishment and command execution.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/rustfly-command-injection-via-udp-remote-control
Various Sources exploit
https://packetstorm.news/files/id/215819/
Scores
CVSS v3
9.8
EPSS
0.0263
EPSS Percentile
83.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
Bixat/RustFly
2.0.0
Published
Feb 19, 2026
Tracked Since
Feb 20, 2026