PT-2026-28353 · Unknown · Thingino-Firmware

Azmi Alsarayrah · Publicado 2026-03-26 · Atualizado 2026-06-03 · CVE-2026-26213

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thingino-firmware versions prior to firmware-2026-03-16

Description The software contains an unauthenticated operating system command injection flaw within the WiFi captive portal CGI script. This allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function within the parse query() and parse post() functions to achieve remote code execution and perform privileged configuration changes. These changes include resetting the root password and modifying SSH authorized keys, potentially leading to full and persistent device compromise.

Recommendations Update thingino-firmware to a version later than firmware-2026-03-16.

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-26213

Produtos afetados

Thingino-Firmware

Referências · 5

• https://github.com/themactep/thingino-firmware/releases/tag/firmware-2026-03-15 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26213 · Nota de Segurança
• https://vulncheck.com/advisories/thingino-firmware-api-cgi-unauthenticated-command-injection-in-captive-portal · Nota
• https://twitter.com/CVEnew/status/2037280591444586735 · Publicação no Twitter
• https://t.me/cveNotify/165808 · Publicação no Telegram