Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-53611 – Unauthenticated Remote Code Execution – Looking Glass (AS203038) < 1.3.5

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-53611 is a critical OS command injection vulnerability in Looking Glass, a network diagnostic platform (developed by AS203038) that exposes ping, traceroute, and BGP lookup functionality via a gRPC API and web UI. The flaw resides in the BGP AS-path input validation logic and allows an unauthenticated remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Technical details

  • Root cause: The SanitizeASPathRegex input validation function uses an unanchored regular expression to validate BGP AS-path input. Because the regex only checks for a matching substring rather than validating the entire input string, it can be satisfied by a payload that contains a valid numeric AS-path sequence followed by additional, unsanitized shell metacharacters (e.g., 65001';id;).
  • Trigger conditions: An attacker submits a crafted BGP AS-path value (via the gRPC/HTTP2 API or the web UI’s BGP lookup feature) containing a valid AS number followed by shell command syntax that breaks out of a single-quoted string context used in an underlying SSH/shell execution template.
  • Attack vector: Network-based (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction required (UI:N) — the endpoint is reachable without authentication.
  • Impact: Successful exploitation results in arbitrary OS command execution in the context of the Looking Glass service/container, enabling full compromise of the container, disclosure of sensitive environment variables, and theft of infrastructure credentials such as SSH private keys.

Affected software

  • Looking Glass (AS203038), package github.com/AS203038/looking-glass/pkg/utils — all versions prior to 1.3.5

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: Upgrade Looking Glass to version 1.3.5 or later, which anchors the AS-path validation regex to enforce strict whole-string matching and closes the injection path.
  • If immediate patching is not possible:
    • Restrict network access to the Looking Glass gRPC/HTTP2 API and web UI to trusted networks only (e.g., via firewall rules or VPN), removing direct internet exposure.
    • Disable or block the BGP AS-path lookup feature at the application or reverse-proxy layer until the upgrade can be applied.
    • Monitor logs for anomalous shell metacharacters (e.g., quotes, semicolons) submitted in AS-path lookup requests as an indicator of exploitation attempts.
    • Rotate any credentials (SSH keys, environment secrets) accessible to the Looking Glass service host, given the risk of prior undetected exploitation.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge