CVE-2026-27476 — RustFly 2.0.0 Command Injection via UDP Remote Control
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization.…
Published: 2026-02-19 · CVSS: 9.3 · CVSS 4.0
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target system, including reverse shell establishment and command execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7