EUVD-2026-94481
GHSA-hr6j-rxpm-qvcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local/authenticated access
-
DeliveryCraft input with special elements
-
ExploitSubmit to vulnerable injection point (CWE-74)
-
ExecutionPayload executed by higher-privileged scope
-
ImpactFull device compromise (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires pre-existing low-privileged authenticated access to an affected device, per the CVSS vector (AV:L, PR:L): the attacker must already be able to reach a local/management interface on Cisco Meraki MR wireless APs, MV cameras, MX security appliances, or Campus Gateway Software and supply input to a component that improperly neutralizes special elements (CWE-74). Limiting factors: no remote network vector (AV:L), authentication is required (PR:L), and the affected products are cloud-managed Meraki devices, so management-plane access control and Meraki dashboard isolation reduce exposure; the exact vulnerable feature and affected firmware versions are not specified in the input and must be confirmed against the Cisco advisory. No user interaction is required (UI:N). |
| Impact | This is a genuine prioritization concern but with important caveats. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) indicates LOCAL attack vector requiring LOW privileges - not remote unauthenticated access - so an attacker must already have authenticated, low-privileged access to the device or adjacent local context before exploitation. The high score is driven by the changed scope (S:C) plus full confidentiality, integrity and availability impact, consistent with a CWE-74 injection flaw that crosses a trust/privilege boundary. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. Notably, these were internally discovered by Cisco's own engineering team (not reported after in-the-wild abuse), which lowers near-term mass-exploitation likelihood. CONFLICT TO VERIFY: the sole 'Information Disclosure' tag understates the CVSS vector, which asserts full I:H/A:H (code-execution/manipulation class impact), not merely disclosure - treat the impact as integrity/availability-affecting, not read-only. Overall: a real patch-soon item for exposed Meraki/Campus Gateway fleets, but the local vector and authentication requirement make it a lower immediate-urgency issue than a remote unauthenticated RCE of the same score. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged authenticated access to an affected Cisco Meraki (MR/MV/MX) or Campus Gateway device submits input containing improperly neutralized special elements (CWE-74 injection) to a vulnerable interface. Because the vulnerability crosses a scope boundary, the injected payload is processed by a higher-privileged component, yielding full compromise of confidentiality, integrity, and availability. No public exploit code is identified at time of analysis, and the flaw was internally discovered rather than observed in the wild. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
RemediationAI
Patch available per vendor advisory: Cisco states that software hardening releases were produced to address these internally discovered issues, so the primary action is to apply the fixed firmware or software release for each affected family - Meraki MR access points, MV cameras, MX security appliances, and Campus Gateway Software - using the per-product version tables in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH); exact fix versions are not specified in the available input data and must be confirmed there rather than assumed. Where immediate upgrade is not possible, compensate by treating the management plane as the trust boundary the vector implies: restrict local console, SSH, and management-interface reachability to a dedicated out-of-band or administrative VLAN so only trusted administrators can supply input to the affected component (trade-off: adds segmentation and troubleshooting overhead, and does not protect against a compromised admin host); enforce least-privilege Meraki dashboard and device roles so no account holds more local privilege than needed, since the vector requires PR:L but not high privilege (trade-off: may disrupt existing workflows for operators accustomed to broad organization-level roles); review dashboard audit logs and local authentication logs for unexpected configuration changes or command-like input patterns, given the integrity impact (trade-off: detection-only, requires log retention beyond default windows); and keep Meraki firmware set to auto-update or schedule an explicit maintenance window, noting that cloud-managed firmware changes can trigger device reboots and brief service interruption. Between these controls and the confirmed patch path, administrators should prioritize devices with the most permissive management access, since scope change (S:C) means a single compromised endpoint can affect resources beyond the vulnerable component.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-74 is a pillar-level classification for improper neutralization of special elements, the root-cause family behind injection flaws such as OS command injection, argument or option injection, expression-language injection, and query injection. In this instance the affected code runs on Cisco Meraki cloud-managed platforms - MR wireless access points, MV cameras, MX security appliances - as well as Cisco Campus Gateway Software, and the flaw arises when a component parses externally supplied input but does not correctly sanitize or escape characters that carry special meaning to a downstream interpreter. Two aspects of the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H shape the risk profile: the scope-changed (S:C) metric indicates that a successful exploit can impact resources beyond the security authority of the vulnerable component itself, which is why impact on all three CIA properties is rated High even though the attacker starts with only low privileges; and the local (AV:L), low-privilege (PR:L), no-user-interaction (UI:N) combination means the practical attack surface is the device management interface rather than an internet-facing service. The CPE data enumerates the affected product families with wildcard version ranges, so the exact vulnerable firmware builds must be confirmed against the Cisco advisory rather than inferred.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vector and low-privilege prerequisite match an authenticated on-device injection; CWE-74 crossing a privilege boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-76472 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
Executive ViewAI
Cisco Meraki MR wireless access points, MV cameras, MX security appliances, and Cisco Campus Gateway Software are affected by an injection-class flaw that an attacker holding existing low-privileged management access could leverage to compromise device confidentiality, integrity, and availability, with a scope change that raises the possibility of impact beyond the device itself. Because the attack path runs through the management plane rather than the public internet, this is primarily an insider, compromised-credential, and lateral-movement risk concentrated in the network, security, and facilities teams that administer these devices. No public exploit has been identified at time of analysis, so this is a hardening-driven priority rather than a crisis, but the breadth of affected product lines across campuses, branches, and physical security deployments means the potential blast radius warrants management attention now.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management and local interface access to trusted administrative networks and jump hosts, enforce least privilege and multi-factor authentication on all management accounts, remove unused or default credentials, monitor management-plane authentication and configuration changes for anomalies, segment affected Meraki MR/MV/MX and Campus Gateway devices away from sensitive internal networks, and track Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH for the hardening releases as they are published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB