EUVD-2026-95968
GHSA-q5p8-3mwf-2hg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach iStoreOS web management interface
-
DeliveryAuthenticate / use authorized session
-
ExploitSubmit malicious task_id to tasks-lib.lua
-
ExecutionInjected Lua code executed by backend
-
ImpactFull device compromise (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the iStoreOS web management interface and the ability to supply a crafted task_id parameter processed by tasks-lib.lua, which is unsafely evaluated leading to Lua code injection. The published CVSS marks this PR:N (no authentication), but the primary disclosure is titled 'authorized-rce', indicating a valid authenticated/authorized session to the management UI is the realistic prerequisite - this is the key limiting factor and should be confirmed. Limited to iStoreOS versions istoreos-24.10.7 and earlier; exposure is further constrained because router/NAS management interfaces are typically not internet-facing by default. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) claims unauthenticated network RCE, yet the primary disclosure reference is literally titled 'authorized-rce.md' (PRISMI-Team VulnDisclos), strongly implying an authenticated/authorized session is actually required - a material contradiction that should be verified before treating this as PR:N. Exploitation signals are modest: EPSS is only 0.27% (18th percentile), there is NO CISA KEV listing, and no SSVC decision data is supplied, so there is no evidence of widespread or automated exploitation. Publicly available exploit code exists (Pastebin plus a GitHub disclosure writeup), which raises opportunistic risk, but POC availability is NOT active exploitation. Net: this is a genuinely high-impact code-injection flaw (CWE-94) in router/NAS firmware, but the real-world priority is tempered by a niche install base, low EPSS, absence of KEV, and a credible indication that authentication is required despite the PR:N score. Treat as elevated-but-not-emergency and verify the auth precondition with the disclosure. |
| Exploit ScenarioDerived | An attacker with network reach to the iStoreOS web management interface submits a crafted task_id value that is unsafely evaluated in tasks-lib.lua, injecting attacker-controlled Lua code (CWE-94) that runs with the service's privileges on the device. Publicly available exploit code (Pastebin and a GitHub disclosure) lowers the effort to reproduce; the disclosure's 'authorized-rce' title indicates a logged-in/authorized session is likely the realistic precondition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in iStoreOS (istoreos-24.10.7 and earlier) lets an attacker who can reach the web management interface supply a crafted task_id value that tasks-lib.lua processes without sanitization and evaluates as Lua code, resulting in arbitrary command execution with the privileges of the management service. The vendor-published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but the primary disclosure is titled 'authorized-rce' and our independent assessment scores the vector at PR:L, meaning a valid authenticated session on the management UI is the realistic prerequisite - a significant limiting factor because iStoreOS router/NAS admin interfaces are typically not exposed to the internet. No CISA KEV entry and no confirmed public exploit code were identified at time of analysis, and EPSS is low at 0.27% (18th percentile), so exploitation is currently opportunistic rather than rampant.
RemediationAI
No vendor-released patch was identified at time of analysis; the version string istoreos-24.10.7 is stated as the last affected release rather than a fixed one, so do not treat an upgrade to that build as a remedy. Track the upstream project at https://github.com/istoreos/istoreos and the firmware distribution point at https://fw.koolcenter.com/iStoreOS/x86_64_efi/ for a release newer than 24.10.7, and apply it as soon as it appears. Until then, apply compensating controls targeted at the exposure path: block access to the web management interface from WAN and from any untrusted VLAN via firewall rules, restricting administration to a dedicated management network or VPN - the trade-off is loss of convenient remote administration, and any temporary WAN rule must be paired with strong authentication. Additionally, enforce unique strong admin credentials and session expiry (the disclosure's 'authorized-rce' framing means valid credentials materially raise exploitability), and if the task/scheduler functionality exposed through tasks-lib.lua is not needed, disable or remove that feature or restrict its endpoints to loopback - though this may break legitimate scheduled jobs. Review appliance logs for unexpected task submissions and monitor the ENISA EUVD entry (EUVD-2026-95968) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-78797) for an update on fix availability; note that the current PR:N versus PR:L discrepancy in the published vector should be clarified with the vendor, because it changes how aggressively perimeter exposure must be reduced.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iStoreOS is an OpenWrt-derived router/NAS operating system distributed by KoolCenter/Linkease, with its web management layer largely written in Lua. CVE-2026-78797 is a CWE-94 code injection in tasks-lib.lua, the module that backs the device's task/scheduler functionality: the task_id parameter is taken from the incoming request and passed into Lua's dynamic evaluation mechanisms (such as load/loadstring-style execution) without validation or escaping, so attacker-controlled content is interpreted as executable Lua rather than as inert data. The core problem is architectural - coupling untrusted request parameters with a language runtime that can synthesize and execute code - and it is aggravated by the fact that the web admin runs with high privileges on the appliance, so a successful injection translates directly into full control of the router or NAS. The provided CPE string (cpe:2.3:a:n/a:n/a) is an unresolved placeholder and cannot be used to scope affected builds; product identification instead rests on the vendor firmware repository and the GitHub project referenced in the disclosure. The public advisory's PR:N rating and the 'authorized-rce' framing of the original write-up are in direct tension, and our assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats the authenticated session requirement as the more plausible scenario pending vendor confirmation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable management UI (AV:N/AC:L); disclosure titled 'authorized-rce' indicates an authenticated session, so PR:L; code injection yields full device compromise (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.
Executive ViewAI
A critical code-execution flaw in iStoreOS (versions up to and including 24.10.7) could allow an attacker holding a valid management-interface session to take full control of routers and NAS appliances that many organizations rely on as network gateways. With no vendor patch currently available, every unpatched appliance remains a potential foothold for lateral movement into the wider estate, and containment depends on network controls and administrative discipline rather than on a software fix. Leadership should track this as an ownership and exposure-management issue for teams running iStoreOS hardware, not as a broad internet-facing crisis.
No vendor-released patch identified at time of analysis. Interim mitigations: keep the management interface off the internet and reachable only from a trusted admin VLAN, VPN, or jump host; enforce MFA and least-privilege administrative accounts; apply reverse-proxy or WAF filtering that rejects crafted task_id values to tasks-lib.lua; enable and monitor management-UI request logging for anomalous task_id parameters; segment, isolate, or decommission affected iStoreOS appliances (istoreos-24.10.7 and earlier) until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB