OS command injection in Felisify SambaBox
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Felisify Information Technologies Industry and Trade Inc. SambaBox before 5.4.1 contains an OS command injection flaw (CWE-78) because special elements are not neutralized before they reach an operating system command. A remote attacker with low privileges can run arbitrary OS commands, with high impact to confidentiality, integrity and availability, without user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Felisify Information Technologies Industry and Trade Inc. | SambaBox | before 5.4.1 | 5.4.1 | Patch available | CNA |
- SambaBox VendorFelisify Information Technologies Industry and Trade Inc. Affected before 5.4.1 Fixed in 5.4.1 Patch available CNA
Remediation
Upgrade SambaBox to version 5.4.1 or later, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA SambaBox (Felisify Information Technologies Industry and Trade Inc.) Fixed in 5.4.1
Timeline
- 2026-10-06 Threatist record created from CVE-2026-85523
- 2026-10-06 Alias added: GHSA-9hwp-5hjw-2623
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: MEDIUM → LOW
- 2026-10-07 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-85523 · CVE Program
- CVE-2026-85523 · NVD
- FIRST EPSS
- GHSA-9hwp-5hjw-2623 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences