'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

RULE（RULE ID：346364）

Rule General Information
Release Date: 2026-10-08
Rule Name: BerriAI LiteLLM MCP Server Test Endpoints Command Injection Vulnerability (CVE-2026-42271)
Severity:
CVE ID:
Rule Protection Details
Description: BerriAI LiteLLM is a proxy service from the BerriAI organization that unifies large language model interfaces. LiteLLM versions 1.74.2 through before 1.83.7 contain a command injection vulnerability. The vulnerability stems from two endpoints used to preview MCP servers accepting the complete server configuration in the request body, including the command, arguments, and environment fields used by the stdio transport. When invoked with a stdio configuration, the endpoints attempt to connect and spawn a child process. The endpoints are protected only by a valid proxy API key without role checks, allowing any authenticated user to run arbitrary commands.
Impact: An attacker could exploit this vulnerability to have unspecified effect.
Affected OS: Windows, Linux, Others
Reference: https://www.cnnvd.org.cn/frontend/detail?vulId=15089
Solutions
Please refer to announcements or patches release by the vendor.