CVE-2026-49199

CriticalCVSS 9.8/10Last modified Jul 21, 2026

Description

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-49206.4The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to,CVE-2026-492009.8The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login CVE-2026-492019.8The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypCVE-2026-492028.6Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules CVE-2026-492038.3Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewrittenCVE-2026-492046.5Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.CVE-2026-492056.5phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-CVE-2026-492062.9rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t iCVE-2026-492085.3Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and noCVE-2026-492096.5Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionControllCVE-2026-49212.7IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error messageCVE-2026-492106.1Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRend
CVE-2026-49199: Critical severity, CVSS 9.8 | Vulnix