What is the CVSS score of CVE-2026-36356?

CVE-2026-36356 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of MeiG FORGE_SLT711 are affected by CVE-2026-36356?

MeiG Smart FORGE_SLT711 cellular gateways running firmware MDM9607.LE.1.0-00110-STD.PROD-1 contain a critical unauthenticated remote command injection vulnerability that allows attackers to execute…

Is there a public PoC exploit available for CVE-2026-36356?

Yes, a public proof-of-concept exploit is available for CVE-2026-36356. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-36356?

Within 24 hours: Inventory all MeiG FORGE_SLT711 devices and firmware versions in production and document network exposure (internal/external access). Within 7 days: Implement network segmentation to restrict access to the GoAhead web server (block inbound traffic to the /action/SetRemoteAccessCfg endpoint); disable remote management features if operationally feasible. Within 30 days: Contact MeiG for firmware patch availability and timeline; begin planning replacement or upgrade to patched firmware versions as they become available.

MeiG FORGE_SLT711 CVE-2026-36356

EUVD-2026-27327 CRITICAL

OS Command Injection (CWE-78)

2026-05-05 mitre

Command Injection N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 18:22 vuln.today

CVSS changed

May 05, 2026 - 18:22 NVD

9.1 (CRITICAL)

DescriptionCVE.org

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.

AnalysisAI

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-STD.PROD-1 allows attackers to execute arbitrary system commands via the /action/SetRemoteAccessCfg endpoint in the GoAhead web server. CVSS 9.1 reflects critical impact with network-accessible attack vector requiring no authentication or user interaction. GitHub repository suggests publicly available exploit code exists (CVE-2026-36356), significantly lowering exploitation barrier for attackers targeting industrial IoT and cellular gateway deployments.

Technical ContextAI

This vulnerability exploits CWE-78 (OS Command Injection) in the GoAhead embedded web server, a lightweight HTTP server commonly deployed in IoT and embedded devices. The /action/SetRemoteAccessCfg endpoint fails to properly sanitize user-supplied input before passing it to system shell commands. The affected MeiG FORGE_SLT711 is a 4G LTE industrial cellular gateway built on Qualcomm's MDM9607 chipset platform, running firmware version MDM9607.LE.1.0-00110-STD.PROD-1. GoAhead's architecture typically runs with elevated system privileges to manage device configuration, meaning injected commands likely execute with root or administrative permissions. The vulnerability exists in the remote access configuration interface, which would normally handle VPN, SSH, or remote management settings-functionality that by design interacts with system-level services.

RemediationAI

Contact MeiG Smart directly through official support channels to request patched firmware for FORGE_SLT711 devices, as no vendor-released patch version is confirmed in available data. No vendor advisory is published at forgeslt711.com or meig.com references provided. Until patched firmware is available, implement immediate network-layer compensating controls: (1) Block external access to the GoAhead web interface (typically TCP ports 80/443) using firewall rules-allow management only from trusted internal networks or VPN connections, with side effect of preventing remote administration convenience. (2) Deploy network segmentation to isolate FORGE_SLT711 gateways into dedicated VLAN with strict ingress/egress filtering-limits lateral movement if compromised but adds infrastructure complexity. (3) Implement application-layer firewall or reverse proxy with input validation to filter requests to /action/SetRemoteAccessCfg endpoint-requires custom WAF rules and ongoing maintenance. (4) Monitor device logs and network traffic for suspicious POST requests containing shell metacharacters (semicolons, pipes, backticks) to /action/ paths-provides detection but not prevention. Given the unauthenticated nature and POC availability, network isolation is the only reliable mitigation until vendor patch is deployed.