CVE-2026-44853

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-448547.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitationCVE-2026-448557.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448567.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448577.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448587.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448597.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-44868.8A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/formEasySetPassword of tCVE-2026-448607.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448617.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448627.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448637.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448647.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface
CVE-2026-44853: High severity, CVSS 7.2 | Vulnix