CVE-2026-96515CWE-434CWE-862broken-access-controlunrestricted-file-upload

CVE-2026-96515

published September 24, 2026

CVSS
8.6
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

This

vulnerability exists in the Netlink ICT HG323RW router due to insufficient

authorization and input validation controls in the diagnostic script import

functionality. An authenticated attacker could exploit this vulnerability by

uploading and executing a specially crafted script through the web management

interface.

Successful exploitation of this vulnerability

could allow the attacker to execute arbitrary operating system commands with

root privileges resulting in complete compromise of the affected device.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00314 · 23.1th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-862 · Missing Authorization
Published
2026-09-24T17:17Z
References (1)
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 11:59Z
    Command Injection Vulnerability in Netlink ICT HG323RW Router
    cvelistv5