CVE-2026-4956
Published: 27 March 2026
Summary
CVE-2026-4956 is a medium-severity Injection (CWE-74) vulnerability in Feishu (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4956 is a SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus version 1.3.44. The issue affects an unknown function within the file /DevicePrint.do?Action=ReadTask of the Parameter Handler component, where manipulation of the State argument triggers the injection. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWEs 74 (Improper Neutralization of Special Elements used in an SQL Command) and 89 (SQL Injection).
The vulnerability can be exploited remotely by unauthenticated attackers with network access and low complexity, requiring no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption within the affected system.
Advisories from VulDB indicate the exploit is public and available for use, with references including detailed entries at vuldb.com/?ctiid.353833, vuldb.com/?id.353833, and vuldb.com/?submit.777534, plus a Feishu document. The vendor was contacted early but provided no response or patches.
Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched Streamax Crocus 1.3.44 instances. No real-world exploitation in the wild or AI/ML relevance is reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16656
Vulnerability details
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Action=ReadTask of the component Parameter Handler. The manipulation of the argument State results in sql injection. The attack can…
more
be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/DevicePrint.do) directly enables remote unauthenticated exploitation for data access/modification per T1190; limited C/I/A impacts and lack of RCE or other primitives preclude additional techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the State argument in the Parameter Handler.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in /DevicePrint.do?Action=ReadTask of Streamax Crocus 1.3.44.
Vulnerability scanning detects the SQL injection vulnerability (CWE-89) remotely exploitable via the State parameter, enabling proactive remediation.