CVEvulnerability

CVE-2026-75937

9.4 CRITICAL Published 2026-10-02 Modified 2026-10-06 Official page ↗
Status
Awaiting Analysis
Published
2026-10-02
Last modified
2026-10-06
Assigner
e8a6bb0b-e373-42b1-a5de-93e314325576
CVSS 4.0 (e8a6bb0b-e373-42b1-a5de-93e314325576)
9.4 CRITICAL — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-78

Description

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References