CVE-2026-114611 schorschii CVE debrief

Who should care

Mobile device management (MDM) administrators, security teams, and IT professionals responsible for managing and securing OCO-Server deployments should be aware of this vulnerability and take necessary actions to prevent exploitation.

Why it matters

The vulnerability in OCO-Server's MDM /profile endpoint allows for device MDM identity disclosure and device-record hijacking, emphasizing the need for prompt verification and patching to prevent exploitation.

• Device MDM identity disclosure
• Device-record hijacking potential
• Verification of OCO-Server version and patching
• Restrictive access controls for MDM endpoints

Technical summary

The OCO-Server's MDM /profile endpoint accepts self-signed PKCS#7 signatures, allowing an attacker to forge a plist with a victim device's serial number and an arbitrary self-signed certificate. This results in the disclosure of the victim device's MDM identity and potential device-record hijacking. The vulnerability is due to the use of `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`, which disables signer certificate chain and trust validation. Affected versions of OCO-Server should be upgraded to version 1.2.3 or later to prevent exploitation. The disclosure of MDM identities could lead to further unauthorized access and control over managed devices.

Defensive priority

Mobile device management (MDM) administrators and security teams should prioritize verifying and upgrading to OCO-Server version 1.2.3 or later to prevent device MDM identity disclosure and device-record hijacking.

Recommended defensive actions

• Verify and upgrade to OCO-Server version 1.2.3 or later
• Review and restrict access to the MDM /profile endpoint
• Monitor for suspicious activity and implement additional security measures
• Implement compensating controls for exposed systems
• Review asset inventory for affected deployments
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and source item provide details on the vulnerability in OCO-Server's MDM /profile endpoint, which accepts self-signed PKCS#7 signatures, leading to device MDM identity disclosure and device-record hijack. The vendor, schorschii, has provided affected versions and patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.