CVE-2026-36829

CriticalCVSS 9.8

Published: 19/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.27%

67th percentile - higher than 67% of all known CVEs

Summary

The embedded HTTP server in Panabit PAP-XM320 up to version 7.7 fails to validate session cookie values, allowing authentication bypass via directory traversal.

Risk Assessment

An unauthenticated attacker can bypass authentication and gain unauthorized access to the device.

Recommendation

Upgrade Panabit PAP-XM320 firmware to a version later than 7.7.

Original NVD description (English source)

An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.