CVE-2026-52469
CVE-2026-52469 is a critical SQL injection flaw in Crocus version 1.3.44. It lets a remote attacker inject malicious SQL through the DeviceInfoMapper.xml file, enabling full control over the affected system. The vulnerability can be exploited without authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Crocus v1.3.44 users who run the software on their devices.
Real-world impact
An attacker can execute arbitrary SQL commands, read or modify sensitive data, and ultimately take complete control of the system.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑reachable, requires no special privileges, and needs no user interaction. It provides an attacker with full confidentiality, integrity, and availability compromise, which is why the score is near the maximum.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources