This vulnerability (CVE-2026-12104) involves improper neutralization of special elements used in OS commands (CWE-78) in the environment and tunnel configuration features of SIMA GmbH Bondix Server on Linux. Authenticated users with configuration write access can inject arbitrary OS commands through specially crafted configuration values passed to server-side scripts. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits have been reported.

An attacker with authenticated configuration write access can execute arbitrary operating system commands on the affected server, potentially leading to full system compromise, data disclosure, or service disruption. The vulnerability impacts confidentiality, integrity, and availability of the system. Since it requires high privileges, the threat is limited to users who already have configuration write access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict configuration write access to trusted administrators only and monitor configuration changes closely. Avoid exposing the configuration interfaces to untrusted networks.