CVE-2025-59106
High · 8.8CVSS
8.8
EPSS
0.8%
Published
Jan 26, 2026
CISA due date
—
The record
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79944 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-272
- CVE-2026-79693 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-272
- CVE-2026-59915 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least… CWE-272
- CVE-2026-49500 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper… CWE-272
- CVE-2026-15271 A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG… CWE-272
- CVE-2026-15270 A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. CWE-272
- GHSA-v52w-28xh-v562 Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding… CWE-272
- CVE-2026-11620 A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. CWE-272