CVE-2026-22095
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
Risk Assessment
The risk includes full server compromise, data theft, or disruption of network services.
Recommendation
Immediately update the software to a version that fixes this vulnerability and restrict access to port 8090 to trusted IP addresses only.
Other vulnerabilities in WebServer
See all- CVE-2026-22102Critical
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
- CVE-2026-22096Critical
The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.
- CVE-2026-1696Medium
The web server does not properly set some HTTP security headers in responses sent to client applications. This can weaken protection against attacks such as XSS, clickjacking, and other threats due to missing security headers.
Original NVD description (English source)
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.