CVE-2026-22902

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buff CVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized CVE-2026-229057.5An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e CVE-2026-229069.8User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration fi CVE-2026-229079.1An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity CVE-2026-229099.1Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, CVE-2026-22917.3dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whic CVE-2026-229109.1The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized ac CVE-2026-229117.5Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain un CVE-2026-229126.1Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to CVE-2026-229136.1Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of