Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-42568. PoCs published by Daniel Miranda, ex-cal1bur.
AI-analyzed exploit summary This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.
Description
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
Exploits (2)
This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.
The repository contains a functional Python PoC for CVE-2026-42568, an LDAP injection vulnerability in YAMCS LdapAuthModule. The exploit demonstrates authentication bypass by injecting malicious LDAP filter strings into the username parameter.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N