VxWorks 7 EUVD-2026-90976

Exploitation requires the VxWorks 7 command shell to be configured to enforce per-user command privileges (the vulnerable per-user privilege-enforcement mode), and the attacker must already hold an authenticated shell account with limited privileges. The flaw triggers only under 'certain shell operations' in which a command is evaluated without the normally-applied privilege check. Limiting factors: this is not exploitable against devices that do not use per-user command privilege enforcement, nor against devices where no low-privilege shell account exists or where the shell is not reachable by the attacker; a valid (if low-privilege) authenticated session is a hard prerequisite (PR:L), which meaningfully narrows the attacker population versus a fully unauthenticated flaw.

This is a genuine high-priority issue, not merely a high-CVSS-but-low-risk finding. The vendor CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring only limited (authenticated) privileges and no user interaction, yielding full confidentiality, integrity, and availability impact via privilege escalation. However, the AV:N rating warrants scrutiny: the flaw resides in the VxWorks command shell, so 'network' exploitability presumes the shell is remotely reachable (e.g., telnet/SSH/target shell exposed) and that the attacker already holds a valid low-privilege shell account - verify shell exposure with the vendor, as on devices where the shell is console/local-only the practical attack vector is local rather than network. No EPSS score, CISA KEV listing, or POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC data supplied. Net assessment: a serious authenticated privilege-escalation bug with a low exploitation bar for any user who already has limited shell access, but the realistic blast radius is bounded by whether/where the shell is exposed and whether per-user command privileges are enforced.

An authenticated user holding a limited-privilege account on a VxWorks 7 command shell configured to enforce per-user command privileges issues a specifically sequenced shell operation that causes a command to be evaluated without the normal privilege check. The command executes with privileges the user was never granted, giving the attacker full control over the device. No public exploit code was identified at time of analysis; exploitation requires an existing low-privilege shell session.