CVE-2026-26213
Last modified
CVE-2026-26213 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulnerability in the WiFi captive portal CGI script that allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function in parse_query() and parse_post() functions to achieve remote code execution and perform privileged configuration changes including root password reset and SSH authorized_keys modification, resulting in full persistent device compromise.. EPSS estimates a 6.24% chance of exploitation in the next 30 days.
Description
thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulnerability in the WiFi captive portal CGI script that allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function in parse_query() and parse_post() functions to achieve remote code execution and perform privileged configuration changes including root password reset and SSH authorized_keys modification, resulting in full persistent device compromise.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Thingino | Thingino Firmware | <= 2026-03-15 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-26213?
How severe is CVE-2026-26213?
How do I fix CVE-2026-26213?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-26206Wazuh is a free and open source platform used for threat pre…6.5
- CVE-2026-26207Discourse is an open source discussion platform. Prior to ve…5.4
- CVE-2026-26208ADB Explorer is a fluent UI for ADB on Windows. Prior to Bet…7.8
- CVE-2026-26209cbor2 provides encoding and decoding for the Concise Binary …7.5
- CVE-2026-2621A security vulnerability has been detected in Sciyon Koyuan …7.3
- CVE-2026-26210KTransformers through 0.5.3 contains an unsafe deserializati…9.8
- CVE-2026-26214Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versi…9.1
- CVE-2026-26215manga-image-translator version beta-0.3 and prior in shared …9.3
- CVE-2026-26216Crawl4AI versions prior to 0.8.0 contain a remote code execu…10
- CVE-2026-26217Crawl4AI versions prior to 0.8.0 contain a local file inclus…7.5
- CVE-2026-26218newbee-mall includes pre-seeded administrator accounts in it…9.8
- CVE-2026-26219newbee-mall stores and verifies user passwords using an unsa…9.3
Are you affected by CVE-2026-26213?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST