Executive brief
A vulnerability in the Raynet RayVentory Scan Engine allows local users to execute unauthorized code with elevated privileges. The software, which is used for IT asset inventory and scanning, improperly searches for Java installations on the system. An attacker can create a specially named directory and file that the scanner will mistakenly execute, potentially leading to a full system compromise or unauthorized data access.
Technical details
A command injection vulnerability exists in the Raynet rvia agent (RayVentory Scan Engine) version 12.6 Update 8 and prior. When the 'oracle' option is invoked without a pre-configured Java path, the agent executes a 'find' command to locate Java binaries. The search criteria for excluding world-writable directories like /tmp are improperly terminated (missing trailing wildcards), and the search patterns for Java binaries use leading wildcards. A local attacker can exploit this by creating a malicious executable at a path such as /tmp/jdk/bin/java. When the agent's Java detection process runs (often via a high-privileged cron job), it identifies and executes the attacker-controlled binary to check its version, resulting in arbitrary code execution with the privileges of the rvia agent.
Affected products
- Raynet RayVentory Scan Engine (rvia) 12.6 Update 8 and earlier
Timeline
- 2026-05-27: disclosed: Vulnerability details and CVE published
- 2026-05-27: advisory: Raynet advisory RSEC200967 referenced