HIGH 8.8 NVD
CVE-2026-27549
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credenti
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.
References
- https://www.certvde.com/en/advisories/VDE-2026-014/
- https://www.certvde.com/en/advisories/VDE-2026-027/
- https://www.certvde.com/en/advisories/VDE-2026-028/
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14123 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.