CVE-2026-22320

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI and web dashboard to become unavailable and leading to a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 18, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-223215.3A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpCVE-2026-223227.1A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker CVE-2026-223237.1A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users CVE-2026-223248.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania alCVE-2026-223258.1Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.CVE-2026-223268.1Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.CVE-2026-223279.9Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.CVE-2026-223287.1Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.CVE-2026-223297.1Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.CVE-2026-22335.3The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable tCVE-2026-223308.1Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.CVE-2026-223318.1Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.