CVE-2026-7865CWE-88

Hidden Console Command

High · published May 5, 2026

CVSS v4.0
7.4
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

A hidden console command is vulnerable to command injection

flaw when control characters are passed to its second argument.

A third party researcher Eugene Lim had discovered vulnerability

in the way console command passes to a popen function call. Attackers with

authenticated access to SSH console of Crestron devices may use to run

underlying OS commands.

The record
Technical detail
CVSS v4.0
7.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00985 · 62.0th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-05-05T15:05Z
EPSS history
Timeline
  • 05 MAY 15:05Z
    Hidden Console Command
    cvelistv5