CVE-2026-14837

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Jul 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-148387.4Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital HumCVE-2026-148397.5The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowiCVE-2026-14844.2A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during lenCVE-2026-148405.3The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwardCVE-2026-148416.1The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTMCVE-2026-148425.3The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowiCVE-2026-148435.3The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handlCVE-2026-148446.8The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in aCVE-2026-148456.1The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storinCVE-2026-148464.5In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validationCVE-2026-148474.3The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related ACVE-2026-148485.4The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-sub
CVE-2026-14837: High severity, CVSS 7.8 | Vulnix