Description
GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.
Published: 2026-09-04
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
References

Fri, 04 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Gfi Software
Gfi Software gfi Exinda Ai
Vendors & Products Gfi Software
Gfi Software gfi Exinda Ai

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server. GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.
Title GFI Exinda AI < 7.6.5 Argument Injection via Tools Iperf Client GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client
References

Fri, 04 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.
Title GFI Exinda AI < 7.6.5 Argument Injection via Tools Iperf Client
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Gfi Software Gfi Exinda Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-04T15:15:22.593Z

Reserved: 2026-08-14T18:01:19.917Z

Link: CVE-2026-74237

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T13:20:08.607

Modified: 2026-09-04T16:17:57.710

Link: CVE-2026-74237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T17:00:17Z

Weaknesses