CVE-2026-20910

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-209119.8A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A speCVE-2026-209129.1Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository cCVE-2026-209135.3Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escCVE-2026-209145.5Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow CVE-2026-209155.4Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pendinCVE-2026-209168.1An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint oCVE-2026-209174.0Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0:CVE-2026-209187.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2026-209197.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-20927.7A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted asseCVE-2026-209207.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-209217.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attac