CERT Polska discloses ICU Boomerang flaws
Two vulnerabilities in ICU Scandinavia Boomerang expose plaintext credentials and allow unauthenticated tampering with facility sensor data, fixed in version 2.4.18.029.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities affecting ICU Scandinavia Boomerang software. CVE-2026-46458 is an information disclosure flaw where sensitive credential files, including service account and SMTP passwords, are exposed in plaintext via static HTTP requests to specific XML files in the webroot, requiring no authentication to exploit. CVE-2026-46459 is a missing authentication issue in the product's device receiver endpoints, allowing unauthenticated remote attackers to read complete facility configurations and write unauthorized data into the sensor database.
Both issues have been addressed in version 2.4.18.029. The vulnerabilities were reported by researcher Marek Figielski (vanilla.pl) through CERT Polska's coordinated vulnerability disclosure process. There is no indication in the report of active exploitation in the wild; this is a standard vendor patch advisory resulting from responsible disclosure.
Mentioned in this report
Detection guidance
Unauthenticated HTTP Request to Boomerang Credential XML File
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated GET requests to XML files whose path or filename suggests credential/service-account/SMTP content, matching the CVE-2026-46458 information disclosure pattern (plaintext credentials served from static webroot XML files with no auth check). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated HTTP Request to Boomerang Credential XML File
description: Detects unauthenticated HTTP GET requests to XML files whose URI contains
credential-related keywords (password, smtp, service, credential, config), consistent
with CVE-2026-46458 where Boomerang exposes plaintext service account and SMTP credentials
via static XML files in the webroot without requiring authentication. Generalises
on method/extension/keyword pattern rather than a specific filename.
tags:
- attack.credential-access
- attack.t1552
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-stem|endswith: .xml
keyword_filter:
cs-uri-stem|contains:
- password
- smtp
- credential
- service
- config
status_ok:
sc-status: 200
condition: selection and keyword_filter and status_ok
falsepositives:
- Legitimate administrative tools or monitoring agents that periodically read the
same configuration XML files over HTTP with valid sessions
- Backup or configuration-export utilities that fetch XML files as part of normal
maintenance
level: high
id: 408fb700-bac3-5ef2-9a35-b805599f1b75
status: experimental
author: Vorant
Unauthenticated Write Request to Boomerang Device Receiver Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP POST/PUT requests to Boomerang device receiver endpoints, matching CVE-2026-46459 where missing authentication allows remote attackers to read facility configuration and write arbitrary data into the sensor database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Write Request to Boomerang Device Receiver Endpoint
description: Detects HTTP POST/PUT requests to Boomerang device receiver endpoints
without an authenticated session, consistent with CVE-2026-46459 missing authentication
on device receiver endpoints that permits unauthenticated remote read of facility
configuration and unauthorized writes into the sensor database. Generalises on method
+ endpoint path segment rather than a specific payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /receiver
- /device
no_auth:
cs-cookie: null
status_ok:
sc-status:
- 200
- 201
condition: selection and no_auth and status_ok
falsepositives:
- Legitimate sensor/device firmware pushing telemetry through an authenticated proxy
that does not forward cookies in logs
- Internal monitoring scripts polling receiver endpoints without session cookies by
design
level: high
id: 5219914d-d8d9-5c8d-b734-832be681f324
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-46458
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs