CVE-2026-26213
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
An unauthenticated OS command injection vulnerability in thingino-firmware up to firmware-2026-03-16 allows remote attackers to execute arbitrary commands as root via the WiFi captive portal CGI script. The flaw exploits unsanitized HTTP parameter names processed by the eval function in parse_query() and parse_post().
Risk Assessment
The organization faces full device compromise, including root password reset and SSH authorized_keys modification, leading to persistent unauthorized access.
Recommendation
Immediately update thingino-firmware to a version newer than firmware-2026-03-16 and restrict management interface access to trusted networks only.
Original NVD description (English source)
thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulnerability in the WiFi captive portal CGI script that allows remote attackers to execute arbitrary commands as root by injecting malicious code through unsanitized HTTP parameter names. Attackers can exploit the eval function in parse_query() and parse_post() functions to achieve remote code execution and perform privileged configuration changes including root password reset and SSH authorized_keys modification, resulting in full persistent device compromise.