CVE-2026-16521

{
  "etk_id": "ETK-2026-2737",
  "cve_id": "CVE-2026-16521",
  "display_id": "CVE-2026-16521",
  "ghsa_id": "GHSA-rwmh-x2cf-2ccg",
  "euvd_id": "EUVD-2026-110621",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in MBD-X12STW-F BMC syslog",
  "summary": "The MBD-X12STW-F BMC syslog functionality is affected by an OS command injection flaw. An attacker able to provide input to the affected BMC function may cause commands to run when its related service is restarted.",
  "mitigation": "Restrict BMC management access to trusted administrators and isolated management networks, and avoid restarting the affected service after untrusted input. No fixed version is recorded; monitor vendor guidance for an update.",
  "vendor": "SMCI",
  "product": "MBD-X12STW-F",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "01.02.08"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MBD-X12STW-F",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 94.64723885,
  "t0_at": "2026-10-27T07:22:05.661000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T07:22:05.661000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T07:22:05.661000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16521"
    }
  }
}