CVE-2026-105110

Summary

This flaw allows unauthenticated attackers to execute arbitrary commands as root via the CLI parameter in the login.xgi CGI endpoint, posing a critical risk due to potential full system compromise.

Exploitability

Exploitation is relatively straightforward with no preconditions required, as the vulnerability is unauthenticated and allows direct root command execution.

Blast radius

If exploited, the attacker could gain full control over the device, leading to data theft, system damage, or denial of service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the login.xgi CGI endpoint or restrict access to it to prevent unauthenticated command execution.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.