CVE-2026-29797

HighCVSS 7.1/10Last modified Oct 11, 2026

Description

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-494

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-29807.2A vulnerability has been found in UTT HiPER 810G up to 1.7.7-1711. Impacted is the function strcpy of the file /goform/setSysAdm. The manipu CVE-2026-29818.8A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711. The affected element is the function strcpy of the file /goform/formTaskEdit_a CVE-2026-298104.3CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CVE-2026-298117.7CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal CVE-2026-298124.3CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.CVE-2026-298286.1DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.CVE-2026-29839.8A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the fi CVE-2026-298398.8DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.CVE-2026-29846.5A vulnerability was identified in SourceCodester Student Result Management System 1.0. This affects an unknown function of the file /admin/c CVE-2026-298405.4JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserControll CVE-2026-29856.3A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /CVE-2026-298567.5An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial