ATEN eco DC chartDefine SQL Injection Information Disclosure Vulnerability

November 13th, 2026
ZDI-26-993 ZDI-CAN-29124

CVE ID

CVE-2026-126965

CVSS Score

2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected Vendors

ATEN

Affected Products

eco DC

Vulnerability Details

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN eco DC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of color references when creating charts. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

Additional Details

Fixed in eco DC 1.2.119


Disclosure Timeline

  • 2026-08-12 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Ahmed Y. Elmogy

Back to Advisories