CVE catalog

CVE-2026-44872

A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbi

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.81% · Oct 25, 2026

A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpearubaosNot reported8.10.0.22fixed
CpearubaosNot reported8.12.0.7fixed
CpearubaosNot reported8.13.1.2fixed
CpearubaosNot reported10.4.1.11fixed
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpearubaoscpeNot reported8.10.0.22Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.12.0.7Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.13.1.2Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.4.1.11Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNVD-CVE-2026-44872Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]