CVE-2026-22897

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-228989.8A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the CVE-2026-228996.5A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can the CVE-2026-22903.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This CVE-2026-229009.8A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerabili CVE-2026-229019.8A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit CVE-2026-229026.7A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then CVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buff CVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized CVE-2026-229057.5An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e CVE-2026-229069.8User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration fi CVE-2026-229079.1An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity