CVE-2026-73749

CriticalCVSS 9.8/10Last modified Sep 22, 2026

Description

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-73757.5UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-737508.8Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacke CVE-2026-737518.8An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary CVE-2026-737528.8An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability all CVE-2026-737538.8Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a pr CVE-2026-737545.3Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user t CVE-2026-737555.7A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privileg CVE-2026-737565.9A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-CVE-2026-737576.4A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side reques CVE-2026-737586.5A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privileg CVE-2026-737596.5Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending speciall CVE-2026-73767.5Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service