CVE-2026-44861
HighSummary
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
Risk Assessment
Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to conduct a security audit and implement appropriate input sanitization filters in the AOS-8 and AOS-10 interfaces to minimize the risk of SQL injection.
Other vulnerabilities in AOS-8, AOS-10
See all- CVE-2026-44864High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44863High
SQL injection vulnerabilities exist in several underlying service components in AOS-8 and AOS-10. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters passed to backend database queries.
- CVE-2026-44862High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44860High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44852High
A remote code execution vulnerability exists in the web-based management interface of AOS-8 and AOS-10 that can be exploited by an authenticated attacker. By exploiting improper input validation in the file path parameter, an attacker could overwrite arbitrary files on the underlying operating system.
Original NVD description (English source)
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.