CVE-2026-60037: OpenSSL command injection in device importer
Published Nov 10, 2026
·Updated
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Event History
Nov 10, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or elevated access?
Yes. The attacker must be remote and have high privileges before exploiting the issue.
2
Is user interaction required for exploitation?
No. The vulnerability is rated as requiring no user interaction.
3
How complex is exploitation once the attacker has the required privileges?
The attack complexity is rated low, indicating no additional complex conditions are identified in the available data.