CVE-2026-18808: CWE-94 Improper Control of Generation of Code ('Code Injection') in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects)

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), which means that KIO improperly controls code generation, allowing an attacker to inject malicious code. The affected product is KIO (Klemsan Internet Objects) from Klemsan Electrical Electronics Inc., with all versions prior to v1.9 vulnerable. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, and it results in high impact on confidentiality, integrity, and availability. The vendor has not provided a remediation level or patch information, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to full compromise of confidentiality, integrity, and availability of the system running KIO before v1.9. This represents a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected service and monitor for suspicious activity related to code injection attempts.