CVE-2026-2668
📋 TL;DR
This vulnerability allows unauthorized access to the user management functionality in Rongzhitong Visual Integrated Command and Dispatch Platform. Attackers can remotely exploit improper access controls to add users or perform other unauthorized actions. Organizations using affected versions of this platform are at risk.
💻 Affected Systems
- Rongzhitong Visual Integrated Command and Dispatch Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the command and dispatch platform, allowing attackers to create administrative accounts, access sensitive operational data, and potentially disrupt critical command functions.
Likely Case
Unauthorized user creation leading to privilege escalation, data exposure, and potential lateral movement within the affected system.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock access to the vulnerable endpoint using network controls
iptables -A INPUT -p tcp --dport [PORT] -m string --string "/dm/dispatch/user/add" --algo bm -j DROP
Web Application Firewall Rule
allAdd WAF rule to block requests to the vulnerable path
Add rule: Block requests containing "/dm/dispatch/user/add" in URI
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system
- Deploy additional authentication and authorization layers in front of the application
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized POST requests to /dm/dispatch/user/add endpoint succeed. Check application version against affected range.Check Version:
Check application interface or configuration files for version information (specific command depends on deployment)Verify Fix Applied:
Verify that unauthorized requests to /dm/dispatch/user/add are properly rejected with appropriate authentication/authorization errors.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /dm/dispatch/user/add
- Unexpected user creation events
- Failed authentication attempts followed by successful user management actions
Network Indicators:
- HTTP POST requests to /dm/dispatch/user/add without proper authentication headers
- Unusual traffic patterns to user management endpoints
SIEM Query:
source="web_logs" AND uri="/dm/dispatch/user/add" AND http_method="POST" AND (user="-" OR auth_status="failed")