CVE-2026-57012

HighCVSS 8.4

Published: 15/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

In the Setup Wizard, there is a missing permission check that allows remote package installation. This could lead to remote privilege escalation without additional execution privileges. User interaction is not required for exploitation.

Risk Assessment

An attacker could remotely install malicious packages, potentially leading to full system or device compromise.

Recommendation

Apply available security patches from the vendor that fix the missing permission check in the Setup Wizard.

Other vulnerabilities in Setup Wizard

CVE-2026-28616High
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original NVD description (English source)

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS