schorschii OCO-Server up to 1.2.2 MDM Enrollment frontend/api-mdm.php checkSignature SERIAL certificate validation

Summaryinfo

A vulnerability described as problematic has been identified in schorschii OCO-Server up to 1.2.2. This impacts the function checkSignature of the file frontend/api-mdm.php of the component MDM Enrollment. The manipulation of the argument SERIAL results in certificate validation. This vulnerability is identified as CVE-2026-114611. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in schorschii OCO-Server up to 1.2.2. It has been classified as problematic. Affected is the function checkSignature of the file frontend/api-mdm.php of the component MDM Enrollment. The manipulation of the argument SERIAL with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. CVE summarizes:

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-114611 since 10/21/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

By approaching the search of inurl:frontend/api-mdm.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-108268). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• schorschii

Name

• OCO-Server

Version

• 1.2.0
• 1.2.1
• 1.2.2

Website

• Product: https://github.com/schorschii/OCO-Server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion