Description
Tosei Online Store Management System ネット店舗管理システム 1.01 版本中，/cgi-bin/monitor.php 的 HTTP POST Request Handler 组件的 system 函数存在 OS 命令注入漏洞。通过对 DevId 参数进行构造性操作，可在目标主机上执行任意系统命令。攻击可能实现远程发起，且公开可用。
Tosei Self-service Washing Machine /cgi-bin/monitor.php 命令执行漏洞（CVE-2026-2944）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-2944
https://cve.imfht.com/detail/CVE-2026-2944?lang=en
https://access.redhat.com/security/cve/cve-2026-2944
https://www.sentinelone.com/vulnerability-database/cve-2026-2944/
https://github.com/advisories/GHSA-wh45-rv58-w5rc
https://www.redpacketsecurity.com/cve-alert-cve-2026-2944-tosei-online-store-management-system/