CVE-2026-33924
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Two OS command injection vulnerabilities were found in the update installation functionality due to insufficient validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, executes arbitrary commands with root privileges.
Risk Assessment
An attacker with administrative privileges can read or modify sensitive data, change the appliance configuration, or shut down the appliance. Exploitation requires valid administrative access.
Recommendation
Apply the vendor patch for the update installation functionality. Restrict administrative access to the appliance and verify the integrity of update bundles.
Other vulnerabilities in Update installation functionality
Original NVD description (English source)
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS