CVE-2026-49008

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials, allowing execution of commands with root privileges on the device.

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials, allowing execution of commands with root privileges on the device.

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials, allowing execution of commands with root privileges on the device.

Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

The root password hash of the device can be obtained through unencrypted information in the firmware.

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.