CVE catalog

CVE-2026-44865

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remot

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpearubaosNot reported8.10.0.22fixed
CpearubaosNot reported8.12.0.7fixed
CpearubaosNot reported8.13.1.2fixed
CpearubaosNot reported10.4.1.11fixed
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpearubaoscpeNot reported8.10.0.22Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.12.0.7Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.13.1.2Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.4.1.11Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNVD-CVE-2026-44865Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]