CVE-2026-82971: QVidium Opera11 CGI Script net_tr.cgi command injection
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of QVidium Opera11 version 3.3.2a26-Ax4x-opera11 are affected. The issue is remotely reachable through the net_tr.cgi CGI script, and no attacker privileges or user interaction are required according to the supplied severity vector.
What does an attacker need to exploit it?
An attacker needs network access to the affected CGI endpoint and can trigger the flaw by manipulating the ipaddr argument. Public exploit disclosure means exploitation may be practical for reachable systems.
Is vendor remediation available?
The vendor states that it has closed and can no longer sell products or provide support. The affected products are no longer supported by the maintainer.
What should be done if the affected product is still deployed?
Because the vulnerable product is unsupported, prioritize removing or replacing affected Opera11 deployments. Until replacement is complete, restrict network access to the CGI interface to reduce remote exposure.