CVE-2026-36828
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A command injection vulnerability in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to v7.7 allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.
Risk Assessment
An attacker with admin panel access can fully compromise the device, execute arbitrary commands, and breach network security.
Recommendation
Update Panabit PAP-XM320 firmware to a version newer than v7.7 or apply the available patch.
Other vulnerabilities in Panabit PAP-XM320
See all- CVE-2026-36829Critical
The embedded HTTP server in Panabit PAP-XM320 up to version 7.7 fails to validate session cookie values, allowing authentication bypass via directory traversal.
- CVE-2026-36827Medium
A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.
Original NVD description (English source)
A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.