SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Gammu SMSD flaw lets attackers execute commands by sending a text message

0
·1 views

A high-severity OS command injection vulnerability (GHSA-9vjj-v46c-c5qf) has been discovered in Gammu SMSD, a widely used SMS gateway daemon. The flaw exists in the Files backend when RunOnReceive is enabled: the SMS sender ID was sanitised to produce a safe filename but not a safe shell token, allowing shell metacharacters to pass through. Because the resulting filename is appended directly to a shell command line, a remote, unauthenticated attacker can execute arbitrary code simply by sending a crafted text message with a malicious alphanumeric sender ID. The vulnerability affects systems used for hospital paging, monitoring alerts, and two-factor authentication setups, running commands with the daemon's privileges. The issue is rated High (CVSS 8.1) and has been patched in Gammu version 1.43.3, published 25 July 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developers Debate: Established Platforms vs. Fast-Moving Indie Alternatives

A developer on DEV Community has posed a question to the developer community about whether they would prefer a large, established platform with millions of users or a smaller, indie alternative that ships updates rapidly and responds to feedback within hours. The discussion centers on the challenge new software products face in gaining user trust, even when they offer superior responsiveness and transparency. The author observes that most developers default to tools they already know, making it difficult for newer products to gain traction regardless of their quality. They are considering building a product based on open-source principles, public development, and community-driven features, and are seeking honest input on what would motivate developers to switch. The post invites candid responses, including from those who would not consider switching from an established platform under any circumstances.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Build Two-Armed Robot Simulation Using ALOHA and MuJoCo via Single Prompt

A developer walkthrough on DEV Community demonstrates how to set up a bimanual manipulation simulation using Stanford's open-source ALOHA robot platform inside the MuJoCo physics simulator. ALOHA, which stands for A Low-cost Open-source Hardware System for Bimanual Teleoperation, features two arms sharing a workspace and is widely used in robotics manipulation research. The scene — including a workbench, open lunchbox, food items, and the dual-arm robot — was generated from a single natural-language prompt using a tool called Drift, eliminating manual scene authoring. The setup replicates real-world tasks like packing a lunchbox, where one arm must stabilize an object while the other manipulates it — a coordination challenge that single-arm robots cannot handle. The article notes that training both arms to cooperate without colliding remains the harder next step in bimanual manipulation research.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Proxy Pattern: How a Surrogate Object Controls Access Without Changing Interfaces

The Proxy Pattern is a structural design pattern that places a surrogate object between a client and a real object to control when and how the real object is accessed. It addresses common performance issues like the N+1 query problem by delaying the loading of heavy objects, such as database relations, until they are actually needed. The pattern shares structural similarities with the Decorator pattern but differs in intent: while Decorator adds behaviour, Proxy manages access. Several variants exist for specific use cases, including Virtual Proxy for lazy loading, Protection Proxy for permission checks, Cache Proxy for storing results, Remote Proxy for network calls, and Logging Proxy for auditing. By intercepting access transparently, the Proxy Pattern allows developers to improve performance and enforce security without modifying existing client code or business logic.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Reddit Powers 93% of AI Software Recommendations, Study of 241 Categories Finds

A researcher conducted a structured experiment across 241 software categories, querying ChatGPT and Gemini with six buyer-style questions each, generating over 5,000 product mentions and tracking every cited source. Reddit appeared as a source in 93% of categories, feeding 1,202 individual answers, while Capterra — a heavily funded software review directory — appeared in only 12%. The study also found that AI recommendations are less consistent than they appear: in 62% of categories, no single product was named across all six answers, suggesting results shift with minor changes in phrasing. Brands with the widest web presence, such as HubSpot (named across 24 categories) and Salesforce (16 categories), were disproportionately recommended regardless of fit. The findings suggest that visibility in community discussions and independent roundups now matters more than optimized profiles on traditional software review platforms.

0 comments Read more at DEV Community
Gammu SMSD flaw lets attackers execute commands by sending a text message · ShortSingh