CVE-2026-0855

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Merit LILINP20
Merit LILINP30
Merit LILINZ70
Merit LILINP60
Merit LILINV10
Merit LILINIPD0
Merit LILINIPR0
Merit LILINLD0
Merit LILINLR0

References

Timeline

Published
Jan 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-08567.8Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administCVE-2026-08574.4Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose passwCVE-2026-08586.1Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of iCVE-2026-08597.8TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deseriCVE-2026-08607.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU ArchiCVE-2026-08618.4Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.3CVE-2026-08626.1The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all vCVE-2026-08639.9Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrCVE-2026-08645.5When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) theCVE-2026-08655.9User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-08676.4The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category,CVE-2026-08686.4The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calen