CVE-2026-18970 in Visual Integrated Command and Dispatch Platform
Summary
by MITRE • 08/06/2026
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The Rongzhitong Visual Integrated Command and Dispatch Platform represents a critical enterprise solution for visual command and dispatch operations that handles sensitive operational data across various industrial sectors. This platform, specifically version up to 20260617, contains a significant security vulnerability within its user management functionality that directly impacts the system's integrity and confidentiality. The vulnerability resides in the /dm/dispatch/user/findAll endpoint where an unknown function processes incoming parameters without proper input validation mechanisms.
The technical flaw manifests as a SQL injection vulnerability that occurs when manipulating the Name argument parameter within the findAll function. This weakness allows attackers to inject malicious SQL commands through the input field, potentially bypassing authentication mechanisms and gaining unauthorized access to the underlying database. The vulnerability's classification aligns with CWE-89 which specifically addresses SQL injection flaws where untrusted data is incorporated into SQL queries without proper sanitization or parameterization techniques. The attack vector is particularly concerning as it enables remote exploitation, meaning malicious actors can leverage this vulnerability from external networks without requiring physical access to the system infrastructure.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete system compromise and potential disruption of critical dispatch operations. Attackers could extract sensitive user credentials, operational data, and potentially escalate privileges to gain administrative control over the platform. The fact that a working exploit has been published indicates that threat actors are actively leveraging this weakness, creating an immediate risk for organizations relying on this platform for mission-critical operations. This vulnerability particularly affects industrial control systems and command dispatch environments where system availability and data integrity are paramount.
The lack of vendor response to early disclosure attempts presents additional operational concerns, as organizations may be left without official patches or mitigation guidance during the active exploitation period. Security practitioners should consider implementing network-level protections such as web application firewalls and database activity monitoring solutions to detect potential exploitation attempts. The vulnerability's presence in a dispatch platform suggests potential impacts on emergency response systems, industrial operations, and critical infrastructure management where timely and accurate data access is essential for operational continuity.
Organizations utilizing this platform should immediately implement compensating controls including input validation at multiple network layers, database query parameterization, and regular security assessments of the affected application components. The ATT&CK framework's T1190 technique for exploitation of remote services and T1071.005 for application layer protocol usage should be considered when developing defensive strategies against this specific vulnerability. Regular monitoring of network traffic patterns and database query logs may help detect exploitation attempts while maintaining operational security posture against known threats targeting industrial control systems and dispatch platforms.