CVE-2026-20892

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-208938.5Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability CVE-2026-208944.8Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administ CVE-2026-208957.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-208969.8Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate CVE-2026-208979.1Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to CVE-2026-208987.2Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalati CVE-2026-20909.8A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /adm CVE-2026-209015.3Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm ad CVE-2026-209028.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-209035.4Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation CVE-2026-209046.5Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility s CVE-2026-209056.6Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a