CVE Catalog
CVE-2026-49188
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.32%
24th percentile - higher than 24% of all known CVEs
Summary
The ai_cmd utility runs with full root permissions and pipes socket inputs directly to popen(), allowing unauthenticated users to execute arbitrary root commands.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary commands with full administrator privileges, leading to complete system compromise.
Recommendation
Restrict access to the ai_cmd utility or apply the available patch from the vendor.
Original NVD description (English source)
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.