CVE-2026-44852

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-296

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-448537.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitationCVE-2026-448547.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitationCVE-2026-448557.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448567.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448577.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448587.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448597.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-44868.8A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/formEasySetPassword of tCVE-2026-448607.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448617.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448627.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448637.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface
CVE-2026-44852: High severity, CVSS 7.2 | Vulnix