CVE-2026-16740: Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.
This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Both virtual-appliance and physical-appliance deployments of TR7 ASP are affected. The affected version ranges are 1.0.40.236 through versions before 1.0.1554.2331, and 1.6.42.239 through versions before 1.6.1554.2331.
Does exploitation require credentials or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The vulnerability allows OS command injection through a missing authentication condition on a critical function. The severity vector indicates high impact to confidentiality, integrity, and availability.
What version should be used to remediate the issue?
Upgrade affected 1.0-series deployments to 1.0.1554.2331 or later, and affected 1.6-series deployments to 1.6.1554.2331 or later.