CVE-2026-4910 | Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44 Endpoint /RemoteFormat.do State sql injection

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. It has been declared as critical. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection.

This vulnerability is referenced as CVE-2026-4910. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.