CVE-2026-32833 is an OS command injection vulnerability in the LT300 3.0 device firmware before version 2.5.12. Authenticated attackers can inject shell metacharacters into the cbid.system.ntp.current POST parameter of the system time configuration interface, enabling arbitrary command execution on the underlying system. This vulnerability arises from improper neutralization of special elements in OS commands. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the device, potentially leading to full system compromise. This can affect the confidentiality, integrity, and availability of the device and its network environment. No known exploits in the wild have been reported at this time.

No official patch or remediation guidance is currently available. The vulnerability affects firmware versions prior to 2.5.12, so upgrading to version 2.5.12 or later (once available) is recommended. Until a fix is released, restrict access to the device's management interface to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.