CVE-2026-27564: Command Injection via PUT in /api/datastorage/data
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to reach the affected API endpoint remotely and authenticate with administrator credentials. The provided data does not indicate that unauthenticated or lower-privileged users can exploit it.
What level of access could successful exploitation provide?
Successful exploitation allows execution of commands with root privileges on the device. This can result in complete compromise of the device's confidentiality, integrity, and availability.
What request is involved in exploitation?
Exploitation involves sending a PUT request to /api/datastorage/data using admin credentials. The vulnerability is an OS command injection in that endpoint.