CVE-2026-66887
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The affected products are missing authorization on state-changing CGIs and session checks are not performed. Technical details were not provided in the description.
Risk Assessment
An attacker can invoke state-changing operations without authorization, potentially leading to unauthorized modification of configuration or data. This may result in a breach of system integrity.
Recommendation
Apply the vendor patch that adds authorization and session checks. Until patched, restrict network access to the CGI interfaces.
Other vulnerabilities in Nieokreślony
See all- CVE-2026-76646High
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected.
- CVE-2026-68491Critical
An insufficient check allowed for the overwrite of arbitrary files via a symlink. Technical details were not provided in the description.
- CVE-2026-66890Critical
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. Technical details were not provided in the description.
Original NVD description (English source)
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS