EIP-2026-101395

PRE-CVE

Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101395. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated OS command injection vulnerability in Osprey Pump Controller 1.0.1 via the 'eventFileSelected' HTTP GET parameter in DataLogView.php, EventsView.php, and AlarmsView.php scripts.

Description

Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textremotehardware
https://www.exploit-db.com/exploits/51306

This exploit demonstrates an unauthenticated OS command injection vulnerability in Osprey Pump Controller 1.0.1 via the 'eventFileSelected' HTTP GET parameter in DataLogView.php, EventsView.php, and AlarmsView.php scripts.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Osprey Pump Controller 1.0.1 (Software Build ID 20211018)
No auth needed
Prerequisites: Network access to the target system · Target system running affected software
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026