What is the CVSS score of CVE-2026-23678?

CVE-2026-23678 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of 10g08 0800gsm Firmware are affected by CVE-2026-23678?

A critical command injection vulnerability exists in Binardat 10G network switches that could allow attackers to execute arbitrary commands on affected devices through the web management interface.

How to fix or mitigate CVE-2026-23678?

Within 24 hours: Inventory all Binardat 10G08-0800GSM switches running V300SP10260209 or earlier and restrict web management access to trusted administrative networks only. Within 7 days: Disable the traceroute diagnostic function if operationally feasible, or implement strict network segmentation isolating affected switches from untrusted networks. Within 30 days: Contact Binardat for patch availability, evaluate firmware upgrade timelines, and consider replacing affected devices if patches are not released by the vendor within 90 days.

10g08 0800gsm Firmware CVE-2026-23678

HIGH

OS Command Injection (CWE-78)

2026-02-24 disclosure@vulncheck.com

Command Injection 10g08 0800gsm Firmware Binardat

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 16:24 nvd

HIGH 8.8

DescriptionCVE.org

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access to the web interface can execute arbitrary CLI commands on the device.

AnalysisAI

Authenticated attackers can achieve remote code execution on Binardat 10G08-0800GSM network switches by injecting the %1a character into the traceroute hostname parameter on the web management interface, allowing arbitrary CLI command execution. The vulnerability affects firmware version V300SP10260209 and earlier, and currently has no available patch. This requires valid web interface credentials but poses significant risk due to its high severity rating and network-accessible attack vector.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects the traceroute diagnostic component of 10G08-0800Gsm Firmware. Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access to the web interface can execute arbitrary CLI commands on the device.