What is the CVSS score of CVE-2026-2686?

CVE-2026-2686 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SECCN Dingcheng G10 are affected by CVE-2026-2686?

A critical vulnerability (CVSS 9.8) exists in SECCN Dingcheng G10 devices that could allow unauthenticated attackers to compromise affected systems.

Is there a public PoC exploit available for CVE-2026-2686?

Yes, a public proof-of-concept exploit is available for CVE-2026-2686. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-2686?

Within 24 hours: Identify and inventory all SECCN Dingcheng G10 3.1.0.181203 devices in your environment and restrict network access to the /cgi-bin/session_login.cgi endpoint. Within 7 days: Implement compensating controls (WAF rules, network segmentation, IP whitelisting) and establish 24/7 monitoring for exploitation attempts. Within 30 days: Develop upgrade or replacement strategy; contact vendor for patch availability timeline; consider migrating critical functions to alternate solutions if patch timeline is uncertain.

SECCN Dingcheng G10 CVE-2026-2686

CRITICAL

Command Injection (CWE-77)

2026-02-19 cna@vuldb.com

Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 19, 2026 - 15:53 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 00:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.