CVE-2026-44864
HighSummary
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
Risk Assessment
Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to review and strengthen the security of the command-line interface and management protocol, as well as to implement appropriate input sanitization mechanisms.
Other vulnerabilities in AOS-8, AOS-10
See all- CVE-2026-44863High
SQL injection vulnerabilities exist in several underlying service components in AOS-8 and AOS-10. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters passed to backend database queries.
- CVE-2026-44862High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44861High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44860High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44852High
A remote code execution vulnerability exists in the web-based management interface of AOS-8 and AOS-10 that can be exploited by an authenticated attacker. By exploiting improper input validation in the file path parameter, an attacker could overwrite arbitrary files on the underlying operating system.
Original NVD description (English source)
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.