Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-26135 Details

Description

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:8.3 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3	CVE	Patch
https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8	CVE	ExploitMitigationVendor Advisory
https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3	[email protected]	Patch
https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8	[email protected]	ExploitMitigationVendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-346	Origin Validation Error	[email protected]
CWE-346	Origin Validation Error	[email protected]

Affected Products

Product	Versions
meshcentral meshcentral	< 1.1.21
CPE cpe:2.3:a:meshcentral:meshcentral:::::::: Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Jan 16, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 20, 2024	New CVE Received	[email protected]