CVE-2026-4956: Streamax Crocus SQLi Vulnerability

CVE-2026-4956 Overview

A SQL injection vulnerability has been identified in Shenzhen Ruiming Technology Streamax Crocus version 1.3.44. The vulnerability exists within the Parameter Handler component, specifically in the /DevicePrint.do?Action=ReadTask endpoint. By manipulating the State argument, an unauthenticated remote attacker can inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to access, modify, or delete sensitive data in the database without authentication. The exploit is publicly available, and the vendor has not responded to disclosure attempts.

Affected Products

• Shenzhen Ruiming Technology Streamax Crocus version 1.3.44
• Streamax Crocus devices with vulnerable Parameter Handler component
• Systems exposing the /DevicePrint.do endpoint to untrusted networks

Discovery Timeline

• 2026-03-27 - CVE-2026-4956 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4956

Vulnerability Analysis

This SQL injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affects the Parameter Handler component of Streamax Crocus firmware. The vulnerable endpoint /DevicePrint.do?Action=ReadTask fails to properly sanitize the State parameter before incorporating it into SQL queries executed against the backend database.

The vulnerability can be exploited remotely over the network without any authentication or user interaction. When successfully exploited, an attacker can manipulate database queries to extract sensitive information, modify existing records, or potentially escalate privileges within the system.

The exploit has been made public, increasing the risk of widespread exploitation. Notably, the vendor was contacted about this vulnerability but did not respond, leaving users without an official patch or remediation guidance.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the Parameter Handler component. The State parameter is directly concatenated or interpolated into SQL queries without proper escaping, parameterized queries, or input validation. This allows attackers to break out of the intended SQL query structure and inject arbitrary SQL commands.

Attack Vector

The attack is network-based, requiring the attacker to have network access to the vulnerable /DevicePrint.do endpoint. No authentication is required, and no user interaction is necessary for exploitation. The attacker crafts a malicious HTTP request containing SQL injection payloads in the State parameter. When the server processes this request, the injected SQL commands are executed against the database.

The vulnerability is exploited by sending specially crafted requests to the /DevicePrint.do?Action=ReadTask endpoint with malicious SQL syntax in the State parameter. Technical details of the exploitation technique are documented in the Feishu Document and VulDB entry #353833.

Detection Methods for CVE-2026-4956

Indicators of Compromise

• Unusual or malformed HTTP requests to /DevicePrint.do?Action=ReadTask containing SQL syntax characters such as single quotes, double dashes, or UNION keywords
• Database error messages in application logs indicating SQL syntax errors or unexpected query behavior
• Unexpected database queries or access patterns from the application server
• Evidence of data exfiltration or unauthorized modifications in database audit logs

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection patterns targeting the /DevicePrint.do endpoint
• Implement intrusion detection/prevention system (IDS/IPS) signatures for SQL injection attack patterns in HTTP traffic
• Enable detailed application and database logging to capture suspicious query activity
• Use SentinelOne Singularity platform to monitor for anomalous process behavior and potential post-exploitation activity on affected systems

Monitoring Recommendations

• Monitor HTTP access logs for requests to /DevicePrint.do containing suspicious characters or SQL keywords in the State parameter
• Enable database query logging and alert on queries containing injection patterns or excessive data retrieval
• Implement network traffic analysis to identify unusual outbound connections from affected devices that may indicate data exfiltration

How to Mitigate CVE-2026-4956

Immediate Actions Required

• Restrict network access to the /DevicePrint.do endpoint using firewall rules or network segmentation
• Implement a web application firewall (WAF) to filter malicious SQL injection payloads before they reach the vulnerable endpoint
• If possible, disable or remove the vulnerable Parameter Handler functionality until a patch is available
• Monitor systems for signs of exploitation and conduct forensic analysis if compromise is suspected

Patch Information

No official patch is currently available from Shenzhen Ruiming Technology. The vendor was contacted during the responsible disclosure process but did not respond. Users should monitor for vendor communications regarding security updates and implement workarounds in the interim. Additional technical information is available through VulDB #353833 and the associated VulDB CTI entry.

Workarounds

• Implement network-level access controls to restrict access to the /DevicePrint.do endpoint to trusted IP addresses only
• Deploy a reverse proxy or WAF with SQL injection protection rules in front of vulnerable devices
• Consider isolating affected Streamax Crocus devices on a separate network segment with limited connectivity
• Evaluate alternative solutions from vendors with better security response practices if no patch is forthcoming

# Example iptables rule to restrict access to the device
# Replace 192.168.1.100 with the IP of the Streamax Crocus device
# Replace 10.0.0.0/24 with your trusted management network

iptables -A INPUT -d 192.168.1.100 -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -d 192.168.1.100 -p tcp --dport 80 -j DROP