CVE-2026-12059: Cellopoint｜CelloOS - Improper Access Control

Synopsis

Improper access control in the SSH service of CelloOS (by Cellopoint) allows an authenticated remote attacker to bypass enforced command restrictions and run arbitrary operating system commands outside the originally permitted scope. The vulnerability is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full read, write, and availability impact on the vulnerable host. A patched-image rebuild at version 4.8.0 Build 20260316 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The SSH service must be reachable over the network; an attacker targets the exposed service from a remote host.

• AuthenticationRequired

  A valid account is needed to reach the vulnerable code path, but any low-privilege credential is sufficient.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental factors required.

Blast Radius

• Reads sensitive files, credentials, and configuration data stored on the host.
• Writes or modifies files and system configuration outside the SSH command restrictions originally enforced.
• Executes arbitrary OS commands, enabling persistence mechanisms, lateral movement, or data exfiltration.
• Disrupts or terminates system services, causing a denial of service on the affected host.