CVE-2026-47688 in Fogproject
Summary
by MITRE • 07/22/2026
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The FOG Project represents a comprehensive open-source solution for computer imaging, cloning, and inventory management that serves organizations requiring centralized system administration capabilities. This system operates as a network-based service that manages multiple client endpoints through various communication protocols including HTTP and HTTPS. The vulnerability under examination affects the authentication mechanisms within the FOGPage class, specifically targeting two critical methods that handle sensitive system operations.
The technical flaw manifests in the improper authorization checks within the client node endpoint of the FOG system. Attackers can exploit this weakness by sending a single unauthenticated HTTP GET request to the vulnerable endpoint, which directly invokes the clearAES method responsible for removing AES encryption credentials from host systems and the clearPMTasks method that deletes all power management scheduled tasks. This represents a critical security oversight where methods designed for administrative use lack proper authentication verification, allowing any external party to manipulate system configurations without presenting valid credentials or session tokens.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential data loss and system disruption scenarios. When an attacker successfully invokes the clearAES method, they effectively remove encryption keys from client systems, potentially rendering encrypted data inaccessible or compromising system security posture. The clearPMTasks functionality creates additional risk by eliminating scheduled power management operations that may include critical maintenance tasks, system updates, or automated backup procedures essential for maintaining operational continuity.
This vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and can be categorized under ATT&CK technique T1566 for initial access through unauthenticated methods. The flaw represents a classic case of insufficient authorization controls where privileged operations are accessible through publicly exposed endpoints without proper session validation or token verification. Organizations utilizing FOG systems may experience significant operational disruption as attackers could systematically wipe encryption credentials across multiple client systems, potentially affecting thousands of devices in large enterprise environments.
The remediation implemented in versions 1.5.10.1832 and 1.6.0-beta.2313 addresses this issue by enforcing proper authentication checks before allowing execution of the vulnerable methods. This fix ensures that only authenticated users with appropriate privileges can invoke clearAES and clearPMTasks operations, thereby protecting against unauthorized system modifications. System administrators should immediately upgrade to these patched versions and conduct thorough security reviews of their FOG deployments to ensure no unauthorized access has occurred. Additionally, implementing network-level access controls and monitoring for suspicious requests to the client endpoint can provide additional defense-in-depth measures against similar exploitation attempts.