Cyber Resilience

CVE-2026-2686

HighRCE

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0228 80.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-2686 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2686 is an OS command injection vulnerability (CWE-77, CWE-78) in SECCN Dingcheng G10 firmware version 3.1.0.181203. It affects the qq function within the /cgi-bin/session_login.cgi file, where manipulation of the User argument enables arbitrary command execution on the underlying operating system.

The vulnerability is exploitable remotely with no privileges required, low complexity, and no user interaction (CVSS v3.1 base score of 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can inject and execute OS commands, potentially achieving full system compromise with high impacts to confidentiality, integrity, and availability.

Advisories documented on VulDB and a GitHub repository (cha0yang1/SECCN) provide details on the vulnerability, including unauthorized remote code execution reproduction and proof-of-concept exploit code. No patches or specific mitigations are detailed in the available information; practitioners should review these references for any updates. The exploit has been publicly disclosed and may be actively used.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely.…

more

The exploit has been disclosed publicly and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

OS command injection in unauthenticated public CGI endpoint directly enables remote exploitation of internet-facing application (T1190) and arbitrary Unix shell command execution (T1059.004) on embedded firmware.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-2152Shared CWE-77, CWE-78
CVE-2026-5677Shared CWE-77, CWE-78
CVE-2026-2157Shared CWE-77, CWE-78
CVE-2026-7136Shared CWE-77, CWE-78
CVE-2026-7121Shared CWE-77, CWE-78
CVE-2026-9387Shared CWE-77, CWE-78
CVE-2026-9477Shared CWE-77, CWE-78
CVE-2026-2063Shared CWE-77, CWE-78
CVE-2026-2847Shared CWE-77, CWE-78

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely identification, prioritization, and remediation of the specific OS command injection flaw in the /cgi-bin/session_login.cgi qq function.

prevent

Implements input validation at the web CGI entry point to detect and block malicious User argument manipulation that enables command injection.

prevent

Provides boundary protection via firewalls or web application gateways to restrict and filter remote access to the vulnerable unauthenticated CGI endpoint.

References