CVE-2026-3120

{
  "id": "CVE-2026-3120",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T12:16:29.393",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection.\n\nThis issue affects SambaBox: from 5.1 before 5.3."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de control inadecuado de la generación de código (’Inyección de código’) en Profelis Information and Consulting Trade and Industry Sociedad Limitada SambaBox permite la inyección de comandos del sistema operativo.\n\nEste problema afecta a SambaBox: desde la 5.1 anterior a la 5.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Profelis Information and Consulting Trade and Industry Limited Company",
          "product": "SambaBox",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.1",
              "lessThan": "5.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-04T12:42:07.685316Z",
          "id": "CVE-2026-3120",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0155",
      "source": "[email protected]"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-26-0155",
      "source": "[email protected]"
    }
  ]
}