CVE-2026-44860
HighSummary
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
Risk Assessment
Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to review and improve input sanitization in service components and restrict access to the command-line interface to trusted users.
Other vulnerabilities in AOS-8, AOS-10
See all- CVE-2026-44864High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44863High
SQL injection vulnerabilities exist in several underlying service components in AOS-8 and AOS-10. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters passed to backend database queries.
- CVE-2026-44862High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44861High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44852High
A remote code execution vulnerability exists in the web-based management interface of AOS-8 and AOS-10 that can be exploited by an authenticated attacker. By exploiting improper input validation in the file path parameter, an attacker could overwrite arbitrary files on the underlying operating system.
Original NVD description (English source)
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.