CVE-2026-36829
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The embedded HTTP server in Panabit PAP-XM320 up to version 7.7 fails to validate session cookie values, allowing authentication bypass via directory traversal.
Risk Assessment
An unauthenticated attacker can bypass authentication and gain unauthorized access to the device.
Recommendation
Upgrade Panabit PAP-XM320 firmware to a version later than 7.7.
Other vulnerabilities in Panabit PAP-XM320
See all- CVE-2026-36828High
A command injection vulnerability in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to v7.7 allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.
- CVE-2026-36827Medium
A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.
Original NVD description (English source)
An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS