Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114611— OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

Quick assessment

Affected
schorschii OCO-Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OCO-Server 是一款自托管的终端管理应用，用于计算机资产盘点、软件部署以及移动设备管理。在 1.2.3 版本之前，Apple MDM 注册端点 在使用 验证签名的注册请求 plist 时，启用了 标志。该标志会禁用对签名者证书链及其信任关系的验证，因此签名仅需与 PKCS#7 数据块中嵌入的任意证书保持内部自洽即可。这意味着，攻击者使用与其无关的自签名证书所生成的签名也会被接受。 由于该端点信任从未经验证的载荷中提取的 （序列号）字段，任何知晓已注册设备序列号的人，均可使用任意自签名证书，伪造一个 plis

CVSS 9.1 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
schorschii OCO-Server < 1.2.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114611

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
Source: CVE Program / CVE List V5
Vulnerability Description
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
schorschii OCO-Server < 1.2.3 -

II. Public POCs for CVE-2026-114611

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114611

请登录查看更多情报信息。

Other References for CVE-2026-114611 (3)

Same Patch Batch · schorschii · 2026-10-22 · 3 CVEs total

CVE-2026-61791 7.4 HIGH OCO-Server: Stored XSS through agent hostnames in command buttons
CVE-2026-114515 6.5 MEDIUM OCO-Server: Self-Service Portal uninstall-job authorization bypass

IV. Related Vulnerabilities

Same product: OCO-Server
Same vendor: schorschii
Same weakness: CWE-295

V. Comments for CVE-2026-114611

No comments yet

Leave a comment