CVE-2026-22313

CRITICAL CVSS 9.1 View on NVD ↗

Description

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22313

Published: Jun 16, 2026 20:16 UTC Modified: Jun 16, 2026 20:47 UTC