Description

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-02T13:18:10.780Z",
  "pubdate": "2026-09-02T13:18:10.780Z",
  "executiveSummary": "The Drupal Gammu SMS Daemon module is subject to a security vulnerability affecting all versions of the software. This vulnerability exposes the underlying system to potential compromise due to improper handling of SMS gateway communications or interface parameters.\nThe primary risk involves unauthorized data manipulation, potential remote code execution, or service disruption, depending on the specific integration points between the Drupal environment and the Gammu SMS Daemon backend.\nThe vulnerability type requires an attacker to possess the capability to interface with the SMS daemon, potentially leveraging misconfigured administrative settings or input validation flaws within the module's interaction layer.\nAffected systems include any Drupal environment utilizing the Gammu SMS Daemon module for SMS messaging functionality. The impact is significant, as successful exploitation could lead to full compromise of the daemon process or the integrated Drupal site, resulting in unauthorized message interception, denial of service, or unauthorized administrative actions.\nAttackers with network access to the daemon's communication interface or those capable of injecting malicious payloads into the Drupal module configuration can execute arbitrary commands or disrupt SMS throughput, compromising the confidentiality and integrity of the messaging infrastructure.",
  "technicalDetails": "The vulnerability within the Drupal Gammu SMS Daemon module stems from insufficient input sanitization and insecure handling of data transmitted between the Drupal application and the Gammu binary interface.\nThe root cause is identified as an unsafe execution flow where external inputs, processed through the Drupal module, are passed directly to the Gammu SMS Daemon without adequate validation or containment. This allows for command injection or parameter manipulation within the daemon communication channel.\nAttack flow typically begins with an adversary identifying a public-facing or internal Drupal instance that utilizes the Gammu SMS Daemon. The attacker interacts with the module's administrative interface or specific API endpoints, injecting crafted payloads designed to influence the execution of the Gammu command-line utilities.\nBecause the Gammu SMS Daemon often runs with elevated privileges to access hardware components (like GSM modems), any vulnerability that permits arbitrary command injection allows the attacker to execute shell commands with the privileges of the service user.\nThe vulnerable component is the integration layer within the Drupal module that bridges Drupal’s PHP environment with the system-level Gammu SMS Daemon via shell execution or piped communication. Since the module does not properly sanitize these calls, it fails to mitigate against meta-character injection, such as semicolons, backticks, or pipe operators, which are used to terminate intended commands and start malicious secondary processes.\nExploitation requirements include network accessibility to the affected Drupal instance or, in some configurations, an authenticated session with sufficient privileges to modify SMS gateway settings. Once the injection is successful, the payload behavior manifests as the execution of unauthorized commands on the host operating system.\nPost-exploitation impact includes the ability for an attacker to gain persistent access, exfiltrate stored SMS traffic, manipulate system logs, or use the compromised server as a pivot point within the internal network. The lack of version-specific security patching necessitates immediate administrative intervention to prevent exploitation, as the flaw resides in the core logic of the module's interaction with the daemon."
}