CVE-2026-78797

Summary

A remote code execution vulnerability exists in iStoreOS versions 24.10.7 and earlier, where an attacker can inject arbitrary code through the task_id parameter in tasks-lib.lua. This allows full system compromise without authentication.

Exploitability

The exploit is highly practical with no authentication required, needing only a network connection to send a crafted task_id parameter to trigger remote code execution.

Blast radius

If exploited, this vulnerability could lead to complete system takeover across all affected iStoreOS installations, potentially impacting thousands of devices in enterprise environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to iStoreOS 24.10.8 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.