SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76472

HIGH(8.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-76472 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "Meraki" and ProcessCommandLine contains "&&" or ProcessCommandLine contains ";" or ProcessCommandLine contains "|" or ProcessCommandLine contains "$" or ProcessCommandLine contains "`" or ProcessCommandLine contains "\" or ProcessCommandLine contains "(" or ProcessCommandLine contains ")"

Splunk SPL

index=* sourcetype=* (Meraki) (("&&" OR ";" OR "|" OR "$" OR "`" OR "\" OR "(" OR ")"))

Sigma

title: Cisco Meraki Command Injection Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: 'Meraki'
    CommandLine|contains:
      - '&&'
      - ';'
      - '|'
      - '$'
      - '`'
      - '\'
      - '(' 
      - ')'
  condition: selection
level: high

Elastic ES|QL

from process where process.parent.executable : "*Meraki*" and (process.args : "*&&*" or process.args : "*;*" or process.args : "*|*" or process.args : "*$*" or process.args : "*`*" or process.args : "*\*" or process.args : "*(*" or process.args : "*)*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen