CVE-2026-44852
HighSummary
A remote code execution vulnerability exists in the web-based management interface of AOS-8 and AOS-10 that can be exploited by an authenticated attacker. By exploiting improper input validation in the file path parameter, an attacker could overwrite arbitrary files on the underlying operating system.
Risk Assessment
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system as a privileged user. This poses a serious threat to the integrity and security of the system.
Recommendation
It is recommended to update to the latest version of AOS-8 or AOS-10 to mitigate this vulnerability. Additionally, appropriate security measures should be implemented to restrict access to the management interface.
Other vulnerabilities in AOS-8, AOS-10
See all- CVE-2026-44864High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44863High
SQL injection vulnerabilities exist in several underlying service components in AOS-8 and AOS-10. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters passed to backend database queries.
- CVE-2026-44862High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44861High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44860High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
Original NVD description (English source)
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.