CVE-2026-3587
Critical · 10.0CVSS
10.0
EPSS
0.7%
Published
Mar 23, 2026
CISA due date
—
The record
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
- CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… CWE-912
- CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
- CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
- CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
- CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… CWE-912
- CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic… CWE-912
- CVE-2026-41446 Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain… CWE-912