CVE-2026-22097
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The firmware update mechanism lacks cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files, potentially leading to arbitrary code execution.
Risk Assessment
An attacker can upload malicious firmware, gaining control over the device and potentially the entire network infrastructure.
Recommendation
Immediately implement cryptographic signature verification for all firmware updates and restrict access to the update function to trusted administrators only.
Original NVD description (English source)
The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.