VULNERABILITY INTELLIGENCE
CVE-2026-63586
CVSS score9.8 CRITICAL
EPSS probability0.93%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-09-03
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.
Weakness classification
- info@cert.vde.com: CWE-78