RCE in Buffalo Open_xdmod
CVE-2026-45777
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privil…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (31.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Buffalo Open_xdmod
- Ubccr Xdmod — versions >= 9.5.0, < 11.0.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-45777?
- CVE-2026-45777 is a critical-severity vulnerability in Buffalo Open_xdmod, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-06-05.
- How severe is CVE-2026-45777?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2026-45777 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.