CVE-2026-1222CWE-434

BROWAN COMMUNICATIONS |PrismX MX100 AP controller - Arbitrary File Upload

High · published January 20, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

🚨 A privileged attacker can easily upload a web shell to the PrismX MX100 AP controller, and that’s as dangerous as it sounds! Think of it as giving a stranger a spare key to your restaurant's back door. Once inside, they can whip up whatever dish (or chaos) they desire without anyone noticing! This vulnerability allows attackers to execute arbitrary code, which means they could completely take over your server. They could steal sensitive information, manipulate your operations, or even bring everything to a halt. It's an absolutely devastating scenario for any organization relying on this controller!

Put simply

Think of it as giving a stranger a spare key to your restaurant's back door. Once inside, they can whip up whatever dish (or chaos) they desire without anyone noticing! The Arbitrary File Upload vulnerability in the PrismX MX100 AP controller lets privileged remote attackers upload malicious files, like web shells, enabling them to execute arbitrary code on the server.

What to do

This vulnerability allows attackers to execute arbitrary code, which means they could completely take over your server. They could steal sensitive information, manipulate your operations, or even bring everything to a halt. It's an absolutely devastating scenario for any organization relying on this controller! To protect your system, patch the PrismX MX100 AP controller to the latest version immediately. Review your configurations and restrict file upload capabilities to trusted types only. Additionally, consider implementing a web application firewall to monitor uploads. You’ve got this! Act quickly, and you’ll strengthen your defenses in no time! 🛡️

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-01-20T06:30Z
EPSS history
Timeline
  • 20 JAN 06:30Z
    BROWAN COMMUNICATIONS |PrismX MX100 AP controller - Arbitrary File Upload
    cvelistv5