EUVD-2026-30951
GHSA-56xv-fjpq-3r4m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.
AnalysisAI
Command injection in Panabit PAP-XM320 firmware up to and including V7.7 enables authenticated remote attackers with management interface access to execute arbitrary shell commands on the underlying OS. The web management interface passes user-controlled input to the backend helper /usr/sbin/pappiw, which processes arguments via eval - a classic CWE-78 pattern that causes attacker-supplied shell metacharacters to be interpreted as commands. No public exploit has been confirmed at time of analysis and this CVE is not listed in the CISA KEV catalog, though a researcher disclosure page is referenced.
Technical ContextAI
The affected product is the Panabit PAP-XM320, a network appliance whose web management interface delegates parameter handling to the backend binary /usr/sbin/pappiw. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the helper uses the shell built-in eval to process its arguments, which causes any attacker-controlled string embedded in those arguments to be expanded and executed as a shell command rather than treated as data. This is a well-understood injection class - eval in shell scripts is inherently unsafe when processing external input because it collapses the boundary between data and code. CPE data in available sources is unpopulated (cpe:2.3:a:n/a:n/a), so precise version enumeration relies solely on the CVE description citing V7.7 as the ceiling version. The ENISA EUVD record EUVD-2026-30951 corroborates the MITRE assignment.
RemediationAI
No specific patched firmware version has been identified in available data. Organizations should consult the Panabit vendor site at https://www.panabit.com/ and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-36827 for firmware update availability. As compensating controls pending a vendor patch: restrict access to the PAP-XM320 web management interface to a dedicated management VLAN or specific trusted administrator IP ranges using ACLs or firewall rules - this directly eliminates network reachability for unauthorized users and reduces the attack surface to insiders or VPN-connected administrators only. If remote web management is not operationally required, disable it entirely. Enforce strong, unique credentials for all management accounts to raise the barrier for credential-based exploitation. Audit management interface logs for anomalous parameter values containing shell metacharacters (semicolons, backticks, dollar signs, pipes). Note that restricting network access does not eliminate the vulnerability - it only reduces exposure until a firmware patch is applied.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today