CVE-2026-39054
HighSummary
Oinone Pamirs version 7.0.0 contains a command injection vulnerability in the CommandHelper.executeCommands method. This method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization.
Risk Assessment
In affected deployments, this can result in arbitrary operating system command execution, posing a serious security risk to the system.
Recommendation
It is recommended to upgrade to the latest version of Oinone Pamirs that addresses this vulnerability and to implement appropriate safeguards against command injection.
Other vulnerabilities in Oinone Pamirs 7.0.0
See all- CVE-2026-8736Medium
A security flaw was discovered in Oinone Pamirs up to 7.2.0 in the request.getParameter function of LocalFileClient.java (RestController component). Manipulation of the uniqueFileName argument results in path traversal. The attack may be carried out on the physical device and the exploit is publicly available.
- CVE-2026-8735Medium
Oinone Pamirs up to 7.2.0 contains a vulnerability in the JsonUtils.parseMap function of PamirsParserConfig.java in the appConfigQuery Interface component. Manipulation leads to deserialization, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond.
Original NVD description (English source)
Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization. In affected deployments, this can result in arbitrary operating system command execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS