{"id":"CVE-2026-114611","aliases":[],"cve":{"records":[{"id":"CVE-2026-114611","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-21T20:34:25.599Z","published":"2026-10-22T17:33:13.611Z","modified":"2026-10-29T02:23:10.004Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-22T17:33:13.611Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T02:23:10.004Z"}],"references":[{"url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295: Improper Certificate Validation","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T02:22:49.207174Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.","score":9.1,"severity":"critical","published":"2026-10-22T17:33:13.611Z","modified":"2026-10-29T02:23:10.004Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"schorschii","name":"OCO-Server","platforms":[],"versions":[{"version":"< 1.2.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-114611"}],"remediation":[],"references":["https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639","https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404","https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df"],"sources":[{"name":"CVE","id":"CVE-2026-114611","modified":"2026-10-29T02:23:10.004Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114611"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:03.293Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T01:10:32.268Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T08:20:33.294Z","attemptedAt":"2026-10-29T08:20:33.294Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T08:20:33.835Z","attemptedAt":"2026-10-29T08:20:33.835Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T08:20:33.237Z","attemptedAt":"2026-10-29T08:20:33.237Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T08:20:33.428Z","attemptedAt":"2026-10-29T08:20:33.428Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-108268","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108268","modified":"Oct 29, 2026, 2:23:10 AM","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-10-29T08:20:33.237Z"},{"source":"NVD","id":"CVE-2026-114611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114611","modified":"2026-10-29T04:18:24.750","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-10-29T08:20:33.294Z"},{"source":"FIRST EPSS","id":"CVE-2026-114611","url":"https://www.first.org/epss/","probability":0.00229,"percentile":0.13665,"date":"2026-10-28","checkedAt":"2026-10-29T08:20:33.428Z"}],"aiSummary":{"text":"OCO-Server versions prior to 1.2.3 are affected by a vulnerability where the MDM/profile endpoint accepts self-signed PKCS#7 signatures, allowing an attacker to disclose a device's MDM identity and hijack its device record. The attacker must know the device's serial number. The impact includes control over the victim device's MDM relationship.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:40:44.080Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114611"}]}}