PT-2026-28353 · Unknown · Thingino-Firmware

Azmi Alsarayrah · CVE-2026-26213 · Published 2026-03-26 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thingino-firmware versions prior to firmware-2026-03-16

Description The software contains an unauthenticated operating system command injection flaw within the WiFi captive portal CGI script. This allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function within the parse query() and parse post() functions to achieve remote code execution and perform privileged configuration changes. These changes include resetting the root password and modifying SSH authorized keys, potentially leading to full and persistent device compromise.

Recommendations Update thingino-firmware to a version later than firmware-2026-03-16.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26213

Affected Products

Thingino-Firmware

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26213.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26213 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26213 · Vendor Advisory
• https://github.com/themactep/thingino-firmware/releases/tag/firmware-2026-03-15 · Note
• https://github.com/themactep/thingino-firmware · Note
• https://twitter.com/CVEnew/status/2037280591444586735 · Twitter Post
• https://vulncheck.com/advisories/thingino-firmware-api-cgi-unauthenticated-command-injection-in-captive-portal · Note
• https://t.me/cveNotify/165808 · Telegram Post