EUVD-2026-47714
GHSA-49wx-869f-rxhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated low-privileged access
-
DeliveryExecute maintenance script
-
ExploitInject path traversal payload
-
ExecutionWrite arbitrary files with elevated privileges
-
ImpactEscalate to root.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local authenticated access to the device with low-level operating system privileges (PR:L as per CVSS). The vulnerability is triggered by executing the core firmware maintenance script, which is present in the default configuration. No remote exploitation vector exists; network access is not needed. |
| Impact | CVSS 3.1 base score 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local, low-complexity attack that yields full compromise. EPSS probability is 0.19% (9th percentile), suggesting very low likelihood of exploitation. CISA SSVC assessment confirms exploitation is 'none', automatable 'no', but technical impact 'total'. The local attack prerequisite and low EPSS mitigate widespread risk, making this a moderate priority for environments where physical or authenticated local access is possible, but not an immediate internet-facing threat. |
| Exploit ScenarioDerived | An authenticated low-privileged user on the device executes the vulnerable maintenance script, injecting crafted path traversal sequences to overwrite sensitive system files and achieve root-level code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
RemediationAI
Upgrade the firmware to version 3.5.9 as detailed in the vendor advisory referenced by CERT/CC. If immediate upgrade is not feasible, restrict local user access to the maintenance script and enforce strict file-system permissions to limit unauthorized script execution. This mitigation may reduce functionality for maintenance tasks but prevents the path traversal vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the core firmware maintenance script of the Analog Way Picturall Quad Compact Mark II, a professional audio/video processing appliance. Affected products, identified by CPE cpe:2.3:a:analog_way:picturall_quad_compact_mark_ii:*:*:*:*:*:*:*:*, include firmware versions up to 3.5.8. Classified as CWE-22 improper path traversal, the flaw stems from insufficient input validation and improper privilege delegation, enabling a low-privileged local user to manipulate file paths and perform unauthorized file operations, ultimately seizing elevated system control.
Know when Picturall Quad Compact Mark Ii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation; low-privileged user can escalate to root, no user interaction needed.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB