high8.8
CVE-2026-36828
A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7.
Impact
A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Panabit | Panabit PAP-XM320 | through 7.7. |
Versions were read from the advisory text. No structured product data has been published for this record yet.