CVE-2026-16740

Summary

This vulnerability allows unauthenticated OS command injection in TR7 ASP on both virtual and physical appliances, enabling attackers to execute arbitrary commands with high privileges. The flaw affects versions before 1.0.1554.2331 and 1.6.1554.2331 respectively.

Exploitability

Exploitation is straightforward with no authentication required, allowing immediate command injection via network access to the affected appliance.

Blast radius

An attacker could gain full system control of the appliance, potentially leading to complete network compromise through lateral movement and privilege escalation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.1554.2331 or 1.6.1554.2331 for the respective appliance types.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.