Qingteng Host Adaptive Security Platform: OS command injection in Security Toolbox

Summary

The Security Toolbox component of the Qingteng Host Adaptive Security Platform (Host Monitoring V3.0) does not neutralize special characters in console parameters. An authenticated console administrator can inject operating system commands that run on attached clients, where the agent runs with root privileges. The attack requires a valid administrator account or session token; the CNA rates the attack vector as adjacent.

Affected

• Qingteng Host Adaptive Security Platform, Host Monitoring V3.0 with Security Toolbox enabled
• Security Toolbox rule package versions before 20260929 (per CVE record)

Fixed in

• Security Toolbox rule package 20260929 or later (per CVE record and Mandiant reference)
• No platform upgrade required (per vendor resolution text in the Mandiant reference)
• Fixed version not independently confirmed with Qingteng; a third-party mirror names 2026029, which conflicts

Workaround

• No vendor-published workaround found.
• Disabling the Security Toolbox may be an interim measure after checking operational impact. This is our own assessment, not a vendor recommendation.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in CISA KEV; no public proof of concept or exploitation reports found at the time of research.
• Published 2026-10-21; NVD status Awaiting Analysis.

Our recommendation

• Inventory whether Qingteng console or agents are deployed, including the Security Toolbox version.
• Request the Qingteng advisory and confirm the fixed rule package version with the vendor before deploying.
• Apply the Security Toolbox rule package update once confirmed; if patching is delayed, consider disabling the Security Toolbox after reviewing impact.
• Restrict console access to management networks, enforce MFA on administrator accounts, and review admin accounts and audit logs.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mandiant MNDT-2026-0038 advisory github.com
• OpenCVE record CVE-2026-105044 app.opencve.io
• ThreatInt CVE-2026-105044 cve.threatint.com
• Qingteng core platform www.qingteng.cn

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:17.