CVE-2026-36827: n/a
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.
AI Analysis
Technical Summary
This vulnerability affects Panabit PAP-XM320 devices running firmware up to version 7.7. The web management interface calls the backend helper /usr/sbin/pappiw and passes user-supplied input to it. The helper uses eval for argument processing without proper sanitization, enabling command injection. Exploitation requires authentication to the management interface, after which an attacker can execute arbitrary shell commands remotely on the affected device.
Potential Impact
An authenticated remote attacker with access to the management interface can execute arbitrary shell commands on the device, potentially leading to full compromise of the affected system. This could allow the attacker to alter device configuration, disrupt network operations, or pivot to other internal systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted administrators only and consider network-level controls to limit exposure. Monitor vendor communications for updates regarding patches or official mitigations.
CVE-2026-36827: n/a
Description
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Panabit PAP-XM320 devices running firmware up to version 7.7. The web management interface calls the backend helper /usr/sbin/pappiw and passes user-supplied input to it. The helper uses eval for argument processing without proper sanitization, enabling command injection. Exploitation requires authentication to the management interface, after which an attacker can execute arbitrary shell commands remotely on the affected device.
Potential Impact
An authenticated remote attacker with access to the management interface can execute arbitrary shell commands on the device, potentially leading to full compromise of the affected system. This could allow the attacker to alter device configuration, disrupt network operations, or pivot to other internal systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted administrators only and consider network-level controls to limit exposure. Monitor vendor communications for updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-06T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0c9534ec166c07b0c548da
Added to database: 5/19/2026, 4:52:04 PM
Last enriched: 5/19/2026, 5:07:10 PM
Last updated: 5/20/2026, 6:19:17 PM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.