CVE-2026-66887
CriticalCVSS 9.6Summary
The affected products are missing authorization on state-changing CGIs and session checks are not performed. Technical details were not provided in the description.
Risk Assessment
An attacker can invoke state-changing operations without authorization, potentially leading to unauthorized modification of configuration or data. This may result in a breach of system integrity.
Recommendation
Apply the vendor patch that adds authorization and session checks. Until patched, restrict network access to the CGI interfaces.
Other vulnerabilities in Nieokreślony
See all- CVE-2026-68491Critical
An insufficient check allowed for the overwrite of arbitrary files via a symlink. Technical details were not provided in the description.
- CVE-2026-66890Critical
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. Technical details were not provided in the description.
Original NVD description (English source)
The affected products are missing authorization on state-changing CGIs and session checks are not performed.