CVE-2026-27563: Command Injection via GET in /api/datastorage/data
Published Sep 16, 2026
·Updated
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:52 AM
Data Sourced
via MITRE·07:52 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs administrative credentials and must be able to reach the affected API endpoint remotely. No user interaction is required.
2
What is the impact if exploitation succeeds?
A successful exploit allows execution of operating-system commands with root privileges on the device. This can result in complete compromise of confidentiality, integrity, and availability.