CVE-2026-22097CWE-347

Missing firmware validation allows remote code execution

Critical · published July 13, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-13T09:10Z
EPSS history
Timeline
  • 13 JUL 09:10Z
    Missing firmware validation allows remote code execution
    cvelistv5