CVE-2026-79861

Summary

AOS-10 contains a command injection flaw in its PAPI service that allows unauthenticated remote attackers to execute arbitrary commands with privileged privileges by sending specially crafted packets.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication, network accessibility, and low complexity required to craft malicious PAPI packets.

Blast radius

Successful exploitation grants full system compromise as a privileged user, enabling complete data theft, system modification, or service disruption across the affected device and potentially connected infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AOS-10 version 2.590 or later, which contains the vendor-provided fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.