Zurück zur Übersicht

METTLER TOLEDO: STARe Software DB2 vulnerable component

VDE-2026-112
Last update
20.10.2026 12:00
Published at
20.10.2026 12:00
Vendor(s)
Mettler-Toledo GmbH
External ID
VDE-2026-112
CSAF Document
Download

Summary

A vulnerability identified as CVE-2026-10109 affects the external component IBM Db2 12.1.2 delivered with STARe v20.00. The vulnerability is associated with improper handling of the pre-authentication DRDA handshake in affected IBM Db2 versions

Impact

Successful exploitation of CVE-2026-10109 could allow remote code execution on systems using the affected external component IBM DB2 12.1.2.

Affected Product(s)

Model no. Product name Affected versions
STARe Software IBM DB2 12.1.2

Vulnerabilities

Expand / Collapse all

Published
20.10.2026 10:08
Severity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary

IBM DB2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

References
cve.org | nvd.nist.gov

Remediation

Update Db2 component of STARe Software V20.00 to version 12.1.4 Update 87349

Acknowledgments

Mettler-Toledo GmbH thanks the following parties for their efforts:

Revision History

Version Date Summary
1.0.0 20.10.2026 12:00 Initial revision