Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-42568. PoCs published by Daniel Miranda.
AI-analyzed exploit summary This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.
Description
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
Exploits (1)
This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N