CVE-2026-2686CWE-77CWE-78

SECCN Dingcheng G10 session_login.cgi qq os command injection

Critical · published February 19, 2026

CVSS v4.0
9.3
EPSS
4%
Percentile
89.9
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.03773 · 89.9th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-19T00:02Z
EPSS history
Timeline
  • 19 FEB 00:02Z
    SECCN Dingcheng G10 session_login.cgi qq os command injection
    cvelistv5