CVE-2026-8735
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Oinone Pamirs up to 7.2.0 contains a vulnerability in the JsonUtils.parseMap function of PamirsParserConfig.java in the appConfigQuery Interface component. Manipulation leads to deserialization, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond.
Risk Assessment
A remote attacker can exploit unsafe deserialization to execute arbitrary code or perform other unauthorized actions. Public availability of the exploit increases the risk.
Recommendation
Restrict access to the appConfigQuery interface to trusted networks. Given the vendor's lack of response, consider applying custom patches or mitigations.
Other vulnerabilities in Oinone Pamirs
See all- CVE-2026-39054High
Oinone Pamirs version 7.0.0 contains a command injection vulnerability in the CommandHelper.executeCommands method. This method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization.
- CVE-2026-8736Medium
A security flaw was discovered in Oinone Pamirs up to 7.2.0 in the request.getParameter function of LocalFileClient.java (RestController component). Manipulation of the uniqueFileName argument results in path traversal. The attack may be carried out on the physical device and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS