CVE-2026-11845

HighCVSS 7.2/10Last modified Oct 26, 2026

Description

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
IEI Integration Corp	iVEC TANK-XM811	< 1.0.4

References

Timeline

Published: Jun 12, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1184505.9Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files CVE-2026-1184588.1The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fix CVE-2026-1184596.3A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate creden CVE-2026-118468.1The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenti CVE-2026-1184608.0Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, ena CVE-2026-1184618.0The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorizati CVE-2026-1184629.2Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some CVE-2026-1184645.8Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect creden CVE-2026-1184655.8Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installat CVE-2026-1184674.3Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers CVE-2026-1184687.2XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing CVE-2026-118474.3The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal vulnerability, allowing authenticated rem