QVidium Opera11 CVE-2026-82971

Exploitation requires network reachability to the appliance's web server and the ability to send a request to the /cgi-bin/net_tr.cgi CGI script with a malicious ipaddr argument. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed, so any attacker who can reach the CGI endpoint over the network can trigger it against the default configuration. The primary limiting factor is exposure: the device must be network-accessible to the attacker (e.g. Internet-facing or on a reachable internal segment); there is no version-specific or non-default-configuration barrier because all Opera11 units running 3.3.2a26-Ax4x are affected.

The only scoring signal provided is a CVSS 4.0 base of 9.3 with vector AV:N/AC:L/AT:N/PR:N/UI:N and high vulnerable- and subsequent-system impact (VC/VI/VA/SC/SI/SA:H), i.e. trivially reachable network-based, unauthenticated, low-complexity command execution - the E:P (Proof-of-Concept) exploit maturity aligns with the reported public POC. No EPSS score and no KEV entry were supplied, so there is no evidence of confirmed active exploitation; the signals point to publicly available exploit code rather than in-the-wild use. The decisive real-world factor is that the product is end-of-life with a defunct vendor: risk cannot be remediated by patching and will only grow over time. Missing data: no CVSS 3.1 vector, no EPSS, and no independent confirmation beyond the VulDB submission.

An attacker with network access to an Opera11 appliance sends a single crafted HTTP request to /cgi-bin/net_tr.cgi with shell metacharacters embedded in the ipaddr parameter (e.g. an IP followed by ';' and an arbitrary command). The injected command runs with the privileges of the CGI process, giving the attacker a foothold to exfiltrate data, pivot into the network, or brick the device. A public POC/exploit is available, lowering the skill required to weaponize this.