CVE-2026-77853

HighCVSS 8.8

Published: 15/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.03%

62th percentile - higher than 62% of all known CVEs

Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands. It requires access to the NETCONF interface.

Risk Assessment

A user with M-Plane (NETCONF) access can execute arbitrary OS commands, potentially leading to full device compromise. It requires NETCONF interface access.

Recommendation

Restrict M-Plane (NETCONF) access to trusted administrators and apply the vendor fix when available. Monitor for unusual commands sent via NETCONF.

Other vulnerabilities in FF-RFI079I4 and FF-RFI078I4

CVE-2026-80217High
A hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. It requires SSH login and enable mode access.

Original NVD description (English source)

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS