CVE-2026-49201
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
Risk Assessment
The risk involves the potential for persistent compromise of system integrity through backdoor injection into backups, which can lead to unauthorized access and control over the device.
Recommendation
It is recommended to immediately update the device firmware to a version that removes the hardcoded AES key and implements secure key management. Until the update, restrict access to the management interface and monitor for suspicious backup operations.
Original NVD description (English source)
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.