{"id":"CVE-2026-105982","kind":"vulnerability","aliases":["CVE-2026-105982"],"related":[],"title":"IPsec VPN input validation flaw lets privileged remote attacker run root commands","description":"Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","summary":"Improper input validation in the IPsec VPN function can let a remote attacker with high privileges inject system commands. Those commands run with root privileges on the affected device.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["command-injection","infrastructure","ipsec","router","vpn"],"not_affected_if":["no-ipsec-vpn-enabled"],"how_to_check":"unknown: no vendor advisory found yet. Check your VPN router/gateway vendor's security advisories (CERT@VDE if an industrial device) for CVE-2026-105982, and whether IPsec VPN is enabled and the management interface reachable by privileged accounts.","fix":null,"status":"open","published_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:11+00:00","updated_at":"2026-11-03T09:21:06+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-03T09:20:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IPsec VPN input validation flaw lets privileged remote attacker run root commands","impact":"high","summary":"Improper input validation in the IPsec VPN function can let a remote attacker with high privileges inject system commands. Those commands run with root privileges on the affected device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ipsec","vpn"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"remote attacker runs system commands as root on the device","analyst_note":"Identify the vendor and product behind the IPsec VPN function and find the vendor advisory for CVE-2026-105982 to get affected versions and fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ipsec-vpn-enabled"],"who_is_affected":"The sources do not name the product or firmware line, so the affected systems are unknown. Teams running an IPsec VPN gateway or appliance should check whether their vendor has published an advisory for this CVE.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":4067,"output_tokens":424,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and product behind the IPsec VPN function and find the vendor advisory for CVE-2026-105982 to get affected versions and fix.","search":"'-105982':15A,18A '-2026':14A,17A 'affect':53B 'allow':64C 'attack':9A,38B,67C 'command':12A,20B,44B,46B,74C 'command-inject':19B 'cve':13A,16A 'devic':54B 'execut':76C 'flaw':5A 'function':33B,62C 'high':40B,69C 'improp':26B,55C 'infrastructur':22B 'inject':21B,42B,72C 'input':3A,27B,56C 'ipsec':1A,23B,31B,60C 'let':6A,35B 'may':63C 'privileg':7A,41B,50B,70C,80C 'remot':8A,37B,66C 'root':11A,49B,79C 'router':24B 'run':10A,47B 'system':43B,73C 'valid':4A,28B,57C 'vpn':2A,25B,32B,61C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the product or firmware line, so the affected systems are unknown. Teams running an IPsec VPN gateway or appliance should check whether their vendor has published an advisory for this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["commandinjection","high","infrastructure","ipsec","router","vpn"],"first_public_at":"2026-11-03T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105982","severity":null,"published_at":"2026-11-03T09:17:10+00:00","modified_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105982:1473","url":null,"severity":null,"published_at":"2026-11-03T09:21:06+00:00","modified_at":"2026-11-03T09:21:06+00:00","first_seen_at":"2026-11-03T09:21:06+00:00","fetched_at":"2026-11-03T09:21:06+00:00","note":"Searched NVD, CERT@VDE advisory list, general web: vendor/product not identifiable yet. CVSS was assigned by info@cert.vde.com (CERT@VDE CNA), so the vendor is likely an industrial/OT vendor with a VDE advisory, but no VDE advisory naming this CVE is indexed (list shows none). Do not guess the product; revisit once the CERT@VDE advisory appears. Similar InHand/Cudy/Teltonika IPsec CVEs found are different IDs, not this one."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}