CriticalCritical vulnerability
CVE-2026-75937 (CVSS 9.4)
NVD · officialPublished Oct 2, 2026Risk 50/100
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Technical details
CVSS
9.4
AV:AdjacentAC:LowPR:NoneUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source