CVE-2026-7703
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw has been found in AV Stumpfl Pixera Two Media Server up to version 25.2 R2 in an unknown function of the Websocket API component, allowing for code injection. The attack can be initiated remotely.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to upgrade to version 25.2 R3 to address this vulnerability. Upgrading the affected component is also advised.
Other vulnerabilities in Websocket API
See all- CVE-2026-97363High
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
- CVE-2026-10825High
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
Original NVD description (English source)
A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 25.2 R3 is recommended to address this issue. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS