CVE-2026-12389

HighCVSS 8.4/10Last modified Nov 10, 2026

Description

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Axis Communications ABAXIS Camera Station Pro>= 5.0, < 5.59
Axis Communications ABAXIS Camera Station Pro>= 6.0, < 6.18

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-12397.5The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a miCVE-2026-123907.8In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl CVE-2026-123915.0An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-lCVE-2026-123925.3An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated CVE-2026-123935.4The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cCVE-2026-123949.8The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated userCVE-2026-123956.5The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing CVE-2026-1239579.9A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. ThisCVE-2026-1239589.9A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgCVE-2026-1239599.1A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-binCVE-2026-123965.4The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allCVE-2026-1239609.9A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Exec
CVE-2026-12389: High severity, CVSS 8.4 | Vulnix