CVE-2026-82971

CriticalCVSS 10.0

Published: 31/08/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Summary

A command injection vulnerability was found in QVidium Opera11 version 3.3.2a26-Ax4x-opera11, affecting an unknown part of the file /cgi-bin/net_tr.cgi in the CGI Script component, through manipulation of the ipaddr argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor has ceased operations and no longer supports these products.

Risk Assessment

A remote attacker can execute arbitrary commands on the device, potentially leading to full device compromise. Since the product is no longer supported, the risk is permanent and no patches are available.

Recommendation

Due to lack of vendor support, it is recommended to decommission these devices and replace them with newer, supported solutions. If not possible, restrict access to the devices and monitor their activity.

Other vulnerabilities in QVidium Opera11

CVE-2025-63213Critical
The QVidium Opera11 device (firmware 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can inject arbitrary commands via a crafted GET request, executed with root privileges.

Original NVD description (English source)

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.