KROMSE explanation

openDCIM has a security flaw (CVE-2026-28517, CVSS 9.3). The official record says: openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization.

Not confirmed yet, but attack code is public, so attacks often follow within days.

Anyone running openDCIM.

• Install the maker's update for openDCIM as soon as it is out.
• Not sure if you use it? KROMSE can check your product for free.