critical · CVSS v3 9.8

CVE-2026-58978

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physic…

Description

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Scores

Severity
critical
CVSS v2
4.6
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-120228

A critical OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B routers. Remote attackers can manipulate group_id/group_name arguments to execute arbitrary commands. The vulnerability can compromise device control and network security.

View analysis

critical

CVE-2026-120279

A critical OS command injection flaw exists in the openvpn_cli handler of WAVLINK WN536AX6-A routers, allowing remote attackers to execute arbitrary commands via the file_id parameter. The vulnerability can be exploited over the network without authentication. It has been publicly disclosed and is actively used by threat actors.

View analysis

critical

CVE-2026-49934

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

View analysis

critical

CVE-2026-58876

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis