CVE-2026-23759 in IOLAN STS
Summary
by MITRE • 03/17/2026
Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c' invocation running as root. An authenticated attacker who can log in to the device can inject shell metacharacters after the 'ps' subcommand to execute arbitrary OS commands with root privileges, leading to full compromise of the underlying operating system.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
This vulnerability exists in Perle IOLAN STS/SCS terminal server devices running firmware versions prior to 6.0, representing a critical command injection flaw that directly compromises system integrity. The vulnerability stems from improper input validation within the restricted shell interface, specifically when processing the 'ps' command. The affected system fails to sanitize user-supplied arguments before passing them to a shell execution context, creating a direct path for privilege escalation. This flaw manifests when authenticated users access the device through Telnet or SSH protocols and execute the ps command with maliciously crafted parameters that bypass normal argument parsing.
The technical implementation of this vulnerability aligns with CWE-77 and CWE-88, which catalog improper input validation and command injection weaknesses respectively. The root cause occurs at the shell command execution layer where user input flows directly into sh -c invocations without adequate sanitization or escaping mechanisms. The restricted shell environment, designed to limit user capabilities, becomes a vector for privilege escalation because the ps command implementation does not properly isolate user parameters from the underlying shell execution. This creates a scenario where an authenticated attacker can inject shell metacharacters such as semicolons, pipes, or backticks after the ps subcommand, effectively bypassing the intended shell restrictions.
The operational impact of this vulnerability extends far beyond simple command execution, as it grants attackers full root privileges on the affected device. The compromised system becomes a potential launching point for lateral movement within network environments, allowing attackers to use the terminal server as a pivot point to access other networked systems. This vulnerability particularly affects enterprise environments where terminal servers serve as critical access points for managing network infrastructure, making the compromise of such devices especially dangerous. The attack surface is further expanded when considering that the vulnerability affects both Telnet and SSH access methods, providing multiple entry vectors for exploitation.
Mitigation strategies should prioritize immediate firmware updates to version 6.0 or later, which address the input sanitization deficiencies in the restricted shell implementation. Network segmentation and access control measures should be implemented to limit direct access to terminal servers, particularly restricting Telnet access which lacks encryption. The principle of least privilege should be enforced through mandatory access controls that prevent authenticated users from executing potentially dangerous shell commands even within restricted environments. Security monitoring should be enhanced to detect unusual command patterns and shell metacharacter usage in terminal server sessions. Additionally, implementing network-based intrusion detection systems can help identify exploitation attempts by monitoring for known attack signatures targeting this specific vulnerability class. Organizations should also consider disabling unnecessary services and implementing multi-factor authentication for terminal server access to reduce the attack surface.