CISA issues update for unauthenticated COS configuration access
23rd article in the last 90 days, one of 537 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues guidance on Terrarium CVE-2026-5752 sandbox escape (Apr 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Leader
- Buyer role
- Technical Implementer / Administrator
- Decision stage
- Post Buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
- Industry
- Education / K-12
Our classification, not the publisher's statement. Best suited for, not only for.
A vulnerability in the configuration management endpoint of the DRC INSIGHT software, specifically the Central Office Services (COS) component, allows an unauthenticated user on the same network as the server to modify the server’s configuration file. The issue is tracked as CVE-2026-5756 and could enable data exfiltration, traffic redirection, or service disruption.
Data Recognition Corporation (DRC) provides software for test proctoring, including the web-based DRC INSIGHT platform. COS is typically deployed on a school or district local area network to host and distribute testing content to student devices. COS uses a unified API router that serves both public content functions (such as exam delivery) and administrative functions, without meaningful separation between content-serving APIs and management APIs. The /v0/configuration endpoint is accessible to systems on the same network as the COS server without authentication or origin validation. Any unauthenticated user or compromised device with network access to the server may submit requests that modify the server’s configuration file. The endpoint accepts and persists user-supplied JSON payloads without validating content, checking authorization, or verifying the safety of requested configuration changes.
Exploitation could allow an attacker to exfiltrate student data by overwriting storage configuration values or credentials so that test artifacts, responses, or audio recordings are sent to attacker-controlled external services instead of intended DRC-managed destinations. An attacker could also intercept or manipulate outbound traffic by inserting a malicious httpsProxy setting, causing HTTPS communications with DRC validation or content services to pass through an attacker-controlled proxy. Malformed JSON, invalid port bindings, or incorrect service endpoints could disrupt operations by preventing the server from starting or interfering with active assessments.
Coordination with the vendor was unsuccessful, and no patch is currently available. Organizations unable to update or modify the application should restrict network access to the COS server by placing it on a dedicated, isolated network segment accessible only to trusted administrative systems. Student and guest networks should not be permitted to reach the server. Host-based or network firewalls should restrict access to the /v0/configuration endpoint, ideally limiting access to localhost or specifically authorized administrative IP addresses. Outbound network traffic should be restricted to approved destinations, such as DRC infrastructure, and monitored for unexpected connections to unknown storage services or proxy endpoints. Administrators should enable logging and monitoring for requests to the /v0/configuration endpoint, unauthorized configuration changes, and unusual outbound traffic patterns, and services should run with least privilege with write access to configuration files limited wherever possible. Signed backups of configuration files should be maintained and their integrity verified before restoration or redeployment.
Requests to the /v0/configuration endpoint can be made without authentication or origin validation by systems on the same network as the COS server, and the endpoint persists user-supplied JSON payloads without validating content, checking authorization, or verifying the safety of requested configuration changes. The advisory identifies CVE-2026-5756 for this configuration modification issue and attributes a disclosure to Caen Jones.
Blog post, originally published at kb.cert.org.