CVE-2026-109830: OS Command Injection
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to manipulate the relevant configuration file. Exploitation also requires a user to execute the affected configuration-derived content on the device.
What is the potential impact if exploitation succeeds?
An attacker could cause arbitrary code to be executed on the device by placing unchecked content in the configuration file.
Which deployments are affected?
The issue affects meta-iot2050 versions V01.03.01 and later. The available information does not state whether any particular default configuration exposes the vulnerable configuration file to attacker modification.