Security Digest: June 7, 2026 - 3 Critical Vulnerabilities

June 7, 2026 brings three high-severity vulnerabilities that can be exploited remotely, including a kernel-level crash in Comodo Internet Security, a command injection flaw in GL.iNet router firmware, and a publicly exploitable SQL injection in Chanjet CRM. Security teams should prioritize patching and exposure reduction today, with special attention to internet-facing systems and endpoints running security software.

· 6 min read

Today's Threats Demand Immediate Action

June 7, 2026 brings three high-severity vulnerabilities that can be exploited remotely, including a kernel-level crash in Comodo Internet Security, a command injection flaw in GL.iNet router firmware, and a publicly exploitable SQL injection in Chanjet CRM. Security teams should prioritize patching and exposure reduction today, with special attention to internet-facing systems and endpoints running security software.

Do not wait for proof of exploitation in your environment. Patch, isolate, and verify now—especially where these products are exposed to untrusted networks or used in production workflows.

Critical Vulnerabilities

CVE-2026-49494: Comodo Internet Security firewall driver IPv6 parser underflow

  • Impact: A remote attacker can send a single crafted IPv6 packet to trigger an out-of-bounds read and, on a separate code path, an oversized memory copy in the Windows kernel. The result is a likely blue screen crash and potential kernel instability before firewall rules are applied.
  • Affected Systems: Systems running Comodo Internet Security with the Inspect.sys firewall driver enabled.
  • Immediate Action: Treat all endpoints with Comodo Internet Security as at risk. Disable or remove the product if a fixed build is not immediately available, and isolate high-value systems from untrusted IPv6 traffic where possible.
  • Mitigation: Apply the vendor patch or updated driver as soon as it is released. Until then, consider limiting IPv6 exposure at the network edge and on hosts, but do not rely on port blocking alone.

CVE-2026-11451: GL.iNet GL-MT3000 FTP handler command injection

  • Impact: Remote attackers may be able to inject commands through the media_dir argument in the FTP protocol handler, potentially leading to unauthorized command execution on the router.
  • Affected Systems: GL.iNet GL-MT3000 firmware 4.4.5 and related affected builds using /cgi-bin/glc and the FTP configuration path.
  • Immediate Action: Upgrade immediately to firmware 4.8.1 or later. If you cannot patch right away, restrict management and NAS/FTP-related interfaces to trusted networks only.
  • Mitigation: Vendor guidance indicates version 4.8.1 escapes single quotes before writing media_dir, preventing the reported payload pattern from executing. Verify the device is on the fixed version and retest exposed interfaces after upgrade.

CVE-2026-11456: Chanjet CRM SQL injection in system table dump handler

  • Impact: Remote attackers can exploit SQL injection in /tools/jxf_dump_systable.php via the gblOrgID parameter, potentially exposing, modifying, or destroying CRM data.
  • Affected Systems: Chanjet CRM 1.0.
  • Immediate Action: Assume exploitability now and remove internet exposure immediately. Block access to the vulnerable endpoint, apply any available vendor fix, and rotate credentials if the system has been reachable from untrusted networks.
  • Mitigation: The exploit is publicly available, so patching alone is not enough if exposure remains. Put compensating controls in place: network restrictions, reverse-proxy filtering, and database access review.

What to Do Now

  1. Patch or isolate today: Upgrade GL.iNet devices to 4.8.1 or later, deploy any Comodo fix immediately, and remove public access to Chanjet CRM.
  2. Reduce exposure: Restrict IPv6 traffic on endpoints where feasible, lock down router admin/NAS interfaces, and block direct access to vulnerable CRM paths.
  3. Verify versions: Check endpoint software inventory for Comodo Internet Security builds using Inspect.sys, confirm GL-MT3000 firmware, and identify any Chanjet CRM 1.0 instances.
  4. Check for abuse: Review logs for unexpected IPv6 packets, suspicious CGI requests to /cgi-bin/glc, and abnormal requests to /tools/jxf_dump_systable.php.
  5. Rotate and recover if exposed: If any system was reachable from the internet, rotate admin and service credentials and inspect for unauthorized configuration changes or data access.

Verification steps: Confirm patched versions are deployed, validate that vulnerable endpoints are no longer internet-facing, and test access controls from an external network. For router and CRM systems, re-run basic access checks after remediation to ensure the attack path is closed.

Monitoring recommendations: Watch for kernel crashes or unexpected reboots on Windows endpoints, repeated FTP/NAS configuration requests on GL.iNet devices, and SQL error patterns or unusual parameter values targeting gblOrgID. Escalate any signs of exploitation immediately.

Related Resources

  • Internal blog posts: Security team guidance on emergency patch validation and external exposure review (to be published).
  • Official vendor advisories: Comodo security update notice for Inspect.sys; GL.iNet firmware release notes for 4.8.1; Chanjet CRM vulnerability advisory and remediation guidance (if published).

Keep reading