EUVD-2026-47714
GHSA-49wx-869f-rxhj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation; low-privileged user can escalate to root, no user interaction needed.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
5DescriptionCVE.org
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
AnalysisAI
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
Technical ContextAI
The vulnerability resides in the core firmware maintenance script of the Analog Way Picturall Quad Compact Mark II, a professional audio/video processing appliance. Affected products, identified by CPE cpe:2.3:a:analog_way:picturall_quad_compact_mark_ii:*:*:*:*:*:*:*:*, include firmware versions up to 3.5.8. Classified as CWE-22 improper path traversal, the flaw stems from insufficient input validation and improper privilege delegation, enabling a low-privileged local user to manipulate file paths and perform unauthorized file operations, ultimately seizing elevated system control.
RemediationAI
Upgrade the firmware to version 3.5.9 as detailed in the vendor advisory referenced by CERT/CC. If immediate upgrade is not feasible, restrict local user access to the maintenance script and enforce strict file-system permissions to limit unauthorized script execution. This mitigation may reduce functionality for maintenance tasks but prevents the path traversal vector.
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today