Live › vulnerability › CVE-2026-36698
Go to dashboardXovis APS-R and APS-B sensors running firmware 2.10.1.1 and earlier pass symlink targets from uploaded parameter archives straight into a shell command. An attacker who can upload a crafted archive can run arbitrary OS commands as root on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Operators running Xovis APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB or APS-B sensors at firmware 2.10.1.1 or earlier. The flaw is in the parameter archive import path, so devices where no one can upload parameter files are less exposed; the sources do not say which network exposure is required.
No product ranges from the sources yet.
2.10.1.12.10.1.1 (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.
This page as .md · .json · in your agent: get_signal("CVE-2026-36698")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.