Ongrowing Adaptive Security Platform RCE via Lua Injection CVE-2026-105044 Advisory

Vulnerability Overview Vulnerability ID: MNDT-2026-0038 Description: In Ongrowing Industrial Adaptive Security Platform (Ongrowing Industrial Adaptive Security Platform) Monitor version 10.0, a remote code execution vulnerability exists due to the Security Toolbox being enabled and the Security Toolbox rule package version being earlier than 2026029. This vulnerability stems from improper handling of injectable variables within Lua scripts, allowing attackers to execute arbitrary code by injecting malicious variables. Impact Scope: High. Authenticated administrators can exploit this vulnerability to compromise the managed host environment. Attackers can perform arbitrary actions, including creating persistent backdoors, modifying security policies, and installing persistent system services. Exploitation Difficulty: High. Requires Console administrator access or an active session token to inject malicious variables. If client devices operate in communication with the host, commands and payloads can be automatically executed within highly protected environments. CVE ID: CVE-2026-105044 Common Weakness Enumeration: CWE-78: OS Command Injection Remediation Update Security Toolbox Rule Package: Upgrade the Security Toolbox rule package to version 2026029 or later. If the platform does not require an upgrade, updating the rule package alone is sufficient. Contact Ongrowing: For detailed remediation and mitigation guidance, customers can contact the Ongrowing support team via email at service@ongrowing.cn or by phone at +86 4006200785, extension 2. Disclosure Timeline 2026-10-06: Ongrowing first reported the issue. 2026-10-09: Ongrowing acknowledged the issue and provided patch 2026029. 2026-10-20: Mandatory advisory published. References cve.org: CVE-2026-105044 The page does not contain POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Ongrowing Adaptive Security Platform RCE via Lua Injection CVE-2026-105044 Advisory

More from this source