CVE-2022-26990

Deeper analysis

CVE-2022-26990 is a command-injection vulnerability affecting the firewall-local log configuration function in three Arris router models: SBR-AC1900P running firmware 1.0.7-B05, SBR-AC3200P running 1.0.7-B05, and SBR-AC1200P running 1.0.5-B05. Unauthenticated attackers can supply crafted values in the EmailAddress, SmtpServerName, SmtpUsername, or SmtpPassword parameters to inject and execute arbitrary operating-system commands. The flaw is tracked as CWE-78 and carries a CVSS 3.1 base score of 9.8.

An attacker with network access to the router’s management interface can submit a single unauthenticated HTTP request that triggers the vulnerable logging routine, resulting in full command execution on the device. Successful exploitation grants the attacker the ability to read or modify configuration files, install persistent malware, or pivot into attached networks without any prior credentials.

Public exploit details were published on GitHub shortly after disclosure. The associated EPSS score rose from a low baseline to a peak of 0.0956 in December 2025 before receding to its current value of 0.0335, indicating a measurable but ultimately limited increase in observed exploitation interest after the vulnerability became public. No vendor firmware updates or official mitigation guidance have been referenced in the available disclosures.