CVE-2026-76757 in Gammu SMS Daemon
Summary
by MITRE • 09/02/2026
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the Gammu SMS Daemon component of the Drupal ecosystem represents a significant security risk for organizations relying on automated messaging services integrated with their content management systems. Gammu is an open-source tool designed to communicate with mobile phones, enabling applications to send and receive SMS messages via various interfaces including serial ports, Bluetooth, and USB modems. When this daemon operates within a Drupal environment, it typically serves as the backend service that processes incoming or outgoing text messages triggered by specific site actions such as user notifications, alerts, or two-factor authentication prompts. The scope of this vulnerability affects all versions denoted by the wildcard pattern .., indicating that every release up to and including the latest available version is susceptible unless a patch has been specifically applied for subsequent updates not covered by this general advisory. This broad impact range underscores the necessity for immediate review and remediation across all infrastructure instances utilizing this integration.
From a technical perspective, vulnerabilities in daemon processes like Gammu often stem from improper input validation or insecure handling of data received from external sources. In the context of Drupal's SMS module, an attacker could potentially exploit weaknesses in how the daemon parses message payloads or handles connection requests from the web application layer. If the daemon fails to adequately sanitize inputs before processing them through underlying system calls or database interactions, it may lead to conditions such as command injection, buffer overflows, or unauthorized access to sensitive configuration files stored on the server hosting the service. The operational impact of such a flaw is severe; successful exploitation could allow an attacker to execute arbitrary commands with the privileges of the user account running the Gammu daemon. This level of compromise effectively grants full control over the messaging infrastructure and potentially provides a foothold for lateral movement within the internal network, especially if the server hosting Drupal also hosts other critical services or databases containing personally identifiable information.
The security implications extend beyond immediate system compromise to include integrity violations and availability disruptions. An attacker leveraging this vulnerability could manipulate SMS messages sent by the organization, leading to reputational damage and loss of trust among users who rely on these communications for account recovery or transactional alerts. Furthermore, if the daemon is configured with elevated privileges to access hardware interfaces directly, exploitation might allow physical layer manipulation or denial-of-service conditions that disrupt communication channels entirely. This aligns closely with Common Weakness Enumeration categories such as CWE-78 Improper Neutralization of Special Elements used in an OS Command for injection flaws and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor if the vulnerability allows reading sensitive logs or configuration data. Additionally, from a tactical standpoint, this type of remote code execution potential maps to MITRE ATT&CK techniques related to Initial Access via Exploitation of Remote Services and Execution through Command and Scripting Interpreters, highlighting its relevance in advanced persistent threat scenarios where automated tools are used for initial foothold establishment.
Mitigation strategies must focus on both immediate containment and long-term architectural hardening. Organizations should immediately apply any available patches provided by the Drupal module maintainers or upstream Gammu developers if a specific fix has been released outside of this general advisory scope. In cases where patching is not immediately feasible, network segmentation becomes critical; the server running the Gammu daemon should be isolated from public-facing networks and restricted to communicate only with trusted internal IP addresses associated with the Drupal application servers. Access controls must be strictly enforced, ensuring that the daemon runs under a dedicated service account with minimal privileges rather than root or administrator rights. Input validation mechanisms within custom code interacting with the SMS API should be reviewed to ensure all parameters are sanitized against injection patterns. Regular security audits and penetration testing focused on external-facing services integrated with backend daemons will help identify similar weaknesses before they can be exploited by malicious actors seeking to disrupt business operations or steal data through compromised communication channels.