CVE-2026-12339
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system, affecting system integrity and availability.
Risk Assessment
An authenticated administrator can overwrite critical system files, potentially leading to full system compromise or denial of service.
Recommendation
Apply the vendor patch that validates file paths during archive extraction. Restrict access to the ISP upgrade functionality to trusted administrators only.
Original NVD description (English source)
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.