CVE-2026-22907

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Jan 15, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity CVE-2026-229099.1Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, CVE-2026-22917.3dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whicCVE-2026-229109.1The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized acCVE-2026-229117.5Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unCVE-2026-229126.1Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to CVE-2026-229136.1Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction ofCVE-2026-229146.5An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manCVE-2026-229156.5An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive informatioCVE-2026-229165.4An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictionsCVE-2026-229177.5Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.CVE-2026-229188.2An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously cra