CERT Polska discloses ICU Boomerang flaws
Two vulnerabilities in ICU Scandinavia Boomerang expose plaintext credentials and allow unauthenticated tampering with facility sensor data, fixed in version 2.4.18.029.
CERT Polska coordinated disclosure of two vulnerabilities affecting ICU Scandinavia Boomerang software. CVE-2026-46458 is an information disclosure flaw where sensitive credential files, including service account and SMTP passwords, are exposed in plaintext via static HTTP requests to specific XML files in the webroot, requiring no authentication to exploit. CVE-2026-46459 is a missing authentication issue in the product's device receiver endpoints, allowing unauthenticated remote attackers to read complete facility configurations and write unauthorized data into the sensor database.
Both issues have been addressed in version 2.4.18.029. The vulnerabilities were reported by researcher Marek Figielski (vanilla.pl) through CERT Polska's coordinated vulnerability disclosure process. There is no indication in the report of active exploitation in the wild; this is a standard vendor patch advisory resulting from responsible disclosure.
Mentioned in this report
Detection guidance
Unauthenticated HTTP Request to Boomerang Credential XML File
Detects unauthenticated GET requests to XML files whose path or filename suggests credential/service-account/SMTP content, matching the CVE-2026-46458 information disclosure pattern (plaintext credentials served from static webroot XML files with no auth check). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated HTTP Request to Boomerang Credential XML File
description: Detects unauthenticated HTTP GET requests to XML files whose URI contains
credential-related keywords (password, smtp, service, credential, config), consistent
with CVE-2026-46458 where Boomerang exposes plaintext service account and SMTP credentials
via static XML files in the webroot without requiring authentication. Generalises
on method/extension/keyword pattern rather than a specific filename.
tags:
- attack.credential_access
- attack.t1552
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-stem|endswith: .xml
keyword_filter:
cs-uri-stem|contains:
- password
- smtp
- credential
- service
- config
status_ok:
sc-status: 200
condition: selection and keyword_filter and status_ok
falsepositives:
- Legitimate administrative tools or monitoring agents that periodically read the
same configuration XML files over HTTP with valid sessions
- Backup or configuration-export utilities that fetch XML files as part of normal
maintenance
level: high
id: 408fb700-bac3-5ef2-9a35-b805599f1b75
status: experimental
author: Vorant
Unauthenticated Write Request to Boomerang Device Receiver Endpoint
Detects unauthenticated HTTP POST/PUT requests to Boomerang device receiver endpoints, matching CVE-2026-46459 where missing authentication allows remote attackers to read facility configuration and write arbitrary data into the sensor database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Write Request to Boomerang Device Receiver Endpoint
description: Detects HTTP POST/PUT requests to Boomerang device receiver endpoints
without an authenticated session, consistent with CVE-2026-46459 missing authentication
on device receiver endpoints that permits unauthenticated remote read of facility
configuration and unauthorized writes into the sensor database. Generalises on method
+ endpoint path segment rather than a specific payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /receiver
- /device
no_auth:
cs-cookie: null
status_ok:
sc-status:
- 200
- 201
condition: selection and no_auth and status_ok
falsepositives:
- Legitimate sensor/device firmware pushing telemetry through an authenticated proxy
that does not forward cookies in logs
- Internal monitoring scripts polling receiver endpoints without session cookies by
design
level: high
id: 5219914d-d8d9-5c8d-b734-832be681f324
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-46458
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free