CVE-2026-16740

CriticalCVSS 9.8

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Summary

A missing authentication for critical function vulnerability exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The lack of authentication enables OS command injection.

Risk Assessment

An unauthenticated attacker can access a critical function and execute arbitrary OS commands, potentially leading to full device compromise. This poses a serious threat to the security of the entire network infrastructure.

Recommendation

Immediately update TR7 ASP to version 1.0.1554.2331 or 1.6.1554.2331 (or later). Additionally, implement authentication for critical functions and restrict network access to management interfaces.

Other vulnerabilities in TR7 ASP

CVE-2026-16741Critical
An OS Command Injection vulnerability (improper neutralization of special elements used in an OS command) exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The vulnerability allows injection and execution of arbitrary operating system commands.

Original NVD description (English source)

Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS