EUVD-2026-69012
GHSA-h952-ggq2-fp3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI endpoint, low complexity; PR:L because authentication is required; High CIA because command injection on embedded device yields full OS control.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in ICP DAS UA-2200 and UA-5200 industrial IoT gateways (firmware up to 20260704) allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ParameterArray argument in the SetHostname CGI API endpoint. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch or mitigation guidance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network-level access to the device's web management interface and must hold at least low-privilege authenticated credentials (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not indicated by the available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 2.1 with all-Low impact ratings (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) is highly inconsistent with command injection on an embedded industrial device, where arbitrary OS command execution typically yields full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, and ICP DAS did not respond to the researcher's disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today