Description

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-02T13:18:10.883Z",
  "pubdate": "2026-09-02T13:18:10.883Z",
  "executiveSummary": "The Drupal Gammu SMS Daemon module is subject to a security vulnerability impacting all versions of the software. This vulnerability exposes the application to potential security compromises due to inadequate input handling or configuration deficiencies inherent in the integration between Drupal and the Gammu SMS Daemon service.\nThe vulnerability type represents a significant security risk, potentially allowing an attacker to manipulate the SMS gateway interface. Depending on the specific implementation, this could lead to unauthorized SMS message dispatch, disclosure of sensitive gateway information, or arbitrary command execution within the context of the underlying system daemon.\nThe attack surface includes any Drupal installation leveraging this module, particularly where the Gammu SMS Daemon is configured with insufficient access controls. Successful exploitation typically requires either local access to the server or, if the web-facing interface is improperly secured, remote exploitation via the Drupal administrative dashboard or API endpoints.\nThe risk implication is critical for services relying on SMS-based two-factor authentication or mission-critical messaging, as the integrity of the communication flow can be subverted by an unauthorized actor. Attackers do not necessarily require high-level credentials if the vulnerability exists in the publicly accessible input validation logic of the module.",
  "technicalDetails": "The vulnerability resides within the Drupal Gammu SMS Daemon module's handling of communications between the Drupal environment and the Gammu SMS Daemon (gammud) backend. The root cause typically involves insufficient sanitization of input passed to the command-line interface or configuration files that control the SMS daemon, potentially allowing for command injection or unauthorized parameter manipulation.\nThe attack flow begins with an attacker identifying a vector to submit malicious input, either through a Drupal form field designated for SMS parameters or via a misconfigured administrative interface. Because the module acts as a bridge to the Gammu service, it may execute shell commands or write to system-level configuration files using the privileges of the web server user (e.g., www-data).\nExploitation proceeds by injecting shell-sensitive characters into parameters passed to the Gammu binary. If the module fails to properly escape these inputs, an attacker can append arbitrary system commands to the execution string, leading to remote code execution (RCE). Alternatively, if the module fails to validate communication channels, an attacker might bypass authentication to send unauthorized SMS messages through the connected modem, potentially incurring financial costs or facilitating phishing campaigns.\nAffected components include the module's backend communication logic that interfaces with /usr/bin/gammu or related daemon control sockets. The vulnerability affects all versions of the Drupal Gammu SMS Daemon module. The attack does not require specialized hardware, only the ability to reach the vulnerable Drupal instance and successfully pass payloads through the module's exposed input interfaces.\nPost-exploitation impact is high, as successful command injection grants the attacker the same permissions as the web server user, enabling them to pivot further into the Drupal database, exfiltrate sensitive site configuration, or establish persistence on the host operating system. The lack of robust input filtering within the module’s core functions remains the primary technical deficiency facilitating this exposure."
}