CVE-2026-36827
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.
Risk Assessment
An authenticated attacker with management interface access can take full control of the device and execute arbitrary commands.
Recommendation
Update Panabit PAP-XM320 firmware to a version newer than V7.7 or apply available patches.
Original NVD description (English source)
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.