CVE-2026-36827

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://secreu.notion.site/CVE-2026-36827-3652c0ab46158036a888ef4a12b104bf
https://www.panabit.com/
https://secreu.notion.site/CVE-2026-36827-3652c0ab46158036a888ef4a12b104bf

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-19 17:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-36827

Mitre link : CVE-2026-36827

CVE.ORG link : CVE-2026-36827

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-36827", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-36827", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T18:34:22.432181Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-19T17:16:21.937", "references": [{"url": "https://secreu.notion.site/CVE-2026-36827-3652c0ab46158036a888ef4a12b104bf", "source": "cve@mitre.org"}, {"url": "https://www.panabit.com/", "source": "cve@mitre.org"}, {"url": "https://secreu.notion.site/CVE-2026-36827-3652c0ab46158036a888ef4a12b104bf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos existe en Panabit PAP-XM320 hasta e incluyendo la versi\u00f3n V7.7. La interfaz de gesti\u00f3n web invoca el ayudante de backend /usr/sbin/pappiw y le pasa par\u00e1metros controlados por el usuario. El ayudante realiza un procesamiento inseguro de argumentos usando eval, lo que permite la inyecci\u00f3n de comandos cuando la entrada controlada por el atacante se incluye en los argumentos. Como resultado, un atacante remoto autenticado con acceso a la interfaz de gesti\u00f3n puede ejecutar comandos de shell arbitrarios."}], "lastModified": "2026-07-24T12:10:00.210", "sourceIdentifier": "cve@mitre.org"}