CVE-2026-2686
Published: 19 February 2026
Summary
CVE-2026-2686 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2686 is an OS command injection vulnerability (CWE-77, CWE-78) in SECCN Dingcheng G10 firmware version 3.1.0.181203. It affects the qq function within the /cgi-bin/session_login.cgi file, where manipulation of the User argument enables arbitrary command execution on the underlying operating system.
The vulnerability is exploitable remotely with no privileges required, low complexity, and no user interaction (CVSS v3.1 base score of 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can inject and execute OS commands, potentially achieving full system compromise with high impacts to confidentiality, integrity, and availability.
Advisories documented on VulDB and a GitHub repository (cha0yang1/SECCN) provide details on the vulnerability, including unauthorized remote code execution reproduction and proof-of-concept exploit code. No patches or specific mitigations are detailed in the available information; practitioners should review these references for any updates. The exploit has been publicly disclosed and may be actively used.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7627
Vulnerability details
A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely.…
more
The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in unauthenticated public CGI endpoint directly enables remote exploitation of internet-facing application (T1190) and arbitrary Unix shell command execution (T1059.004) on embedded firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, prioritization, and remediation of the specific OS command injection flaw in the /cgi-bin/session_login.cgi qq function.
Implements input validation at the web CGI entry point to detect and block malicious User argument manipulation that enables command injection.
Provides boundary protection via firewalls or web application gateways to restrict and filter remote access to the vulnerable unauthenticated CGI endpoint.