CVE-2026-75937

critical · 9.4

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

9.4

CVSS

0.5%

EPSS (exploit prob.)

45th

EPSS percentile

2026-10-02

Published

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

References

https://www.digi.com/resources/security

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-75937