CVE-2026-23678

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access to the web interface can execute arbitrary CLI commands on the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-236795.5libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a maCVE-2026-23687.1An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinCVE-2026-236814.3Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific functiCVE-2026-236834.3SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in esCVE-2026-236845.9A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in CVE-2026-236854.4Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access couldCVE-2026-236863.4Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could sCVE-2026-236878.8SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mesCVE-2026-236884.3SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalationCVE-2026-236897.7Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and neCVE-2026-23699.1A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a bufCVE-2026-2369310.0ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9