A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system… (CVE-2026-75937)
CVE-2026-75937 is a critical vulnerability where an unauthenticated attacker can execute arbitrary operating system commands with root privileges via a specially crafted HTTP POST request to the web administration interface. Disabling the web server when not configuring the device is recommended as a mitigation. No patch or official fix information is provided.
AI Analysis
Technical Summary
This vulnerability allows an unauthenticated attacker to send a specially crafted HTTP POST request to the web administration interface of the affected device, resulting in arbitrary command execution with root privileges. The vulnerability is classified under CWE-78 (OS Command Injection). The CVSS 4.0 vector indicates a critical severity with high impact on confidentiality, integrity, and availability, and no privileges or user interaction required for exploitation. No patch or remediation details are available, and the device is not a cloud service.
Potential Impact
Successful exploitation grants an unauthenticated attacker root-level command execution on the affected device, potentially leading to full system compromise including data theft, system manipulation, or denial of service.
Mitigation Recommendations
The vendor advisory does not provide patch or official remediation details. The only recommended mitigation is to disable the web server when it is not actively being used for device configuration. Monitor vendor channels for updates and patches.
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system… (CVE-2026-75937)
Description
CVE-2026-75937 is a critical vulnerability where an unauthenticated attacker can execute arbitrary operating system commands with root privileges via a specially crafted HTTP POST request to the web administration interface. Disabling the web server when not configuring the device is recommended as a mitigation. No patch or official fix information is provided.
CVSS v4.0
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability allows an unauthenticated attacker to send a specially crafted HTTP POST request to the web administration interface of the affected device, resulting in arbitrary command execution with root privileges. The vulnerability is classified under CWE-78 (OS Command Injection). The CVSS 4.0 vector indicates a critical severity with high impact on confidentiality, integrity, and availability, and no privileges or user interaction required for exploitation. No patch or remediation details are available, and the device is not a cloud service.
Potential Impact
Successful exploitation grants an unauthenticated attacker root-level command execution on the affected device, potentially leading to full system compromise including data theft, system manipulation, or denial of service.
Mitigation Recommendations
The vendor advisory does not provide patch or official remediation details. The only recommended mitigation is to disable the web server when it is not actively being used for device configuration. Monitor vendor channels for updates and patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qqmh-gh5m-j2h2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-75937"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac139b9a43b0b3b89d69d2e
Added to database: 10/03/2026, 17:22:01 UTC
Last enriched: 10/03/2026, 17:41:59 UTC
Last updated: 10/03/2026, 20:45:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.