CVE-2026-36698 in APS-B
Summary
by MITRE • 10/26/2026
Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability represents a critical OS command injection flaw within the firmware of Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B devices running version 2.10.1.1 or earlier. This security defect is located specifically in the /sbin/ImportParamSet.sh script, which serves as a mechanism for administrators to upload parameter archive files for device configuration management. The core technical failure lies in how this script handles symbolic links contained within these uploaded archives. When processing such files, the script extracts symlink targets and directly embeds them into shell commands without implementing any form of input sanitization or proper quoting mechanisms. This lack of validation allows an attacker to manipulate the file structure to inject arbitrary command strings that will be interpreted by the underlying operating system shell rather than treated as literal path data.
The operational impact of this vulnerability is severe due to the execution context in which the flawed script operates. The compromised command is executed with root privileges through APC_SendMsg IPC, a process communication mechanism used for administrative tasks on these embedded devices. Because the injection occurs at the root level, successful exploitation grants an attacker full control over the underlying operating system of the affected device. This effectively bypasses all user-level access controls and allows for complete compromise of the network infrastructure element. An attacker could leverage this to install persistent backdoors, exfiltrate sensitive configuration data, pivot into other parts of the internal network, or disrupt service availability by modifying critical system files or processes.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The specific attack vector involves manipulating file inputs to influence command execution flow, which also relates to CWE-94 Improper Control of Generation of Code or Script where the code is not properly sanitized before interpretation. In terms of tactical mapping within the MITRE ATT&CK framework for IoT and embedded systems, this flaw facilitates initial access through exploitation of application layer vulnerabilities and enables privilege escalation by leveraging existing administrative functions that run with elevated permissions. The attack pattern corresponds to techniques involving command injection via file upload mechanisms where input validation is insufficient.
Mitigation strategies must address both the immediate technical defect and broader security hygiene practices for embedded IoT devices. The primary remediation involves updating the device firmware to a version released after 2.10.1.1 that includes patches for this specific script vulnerability. If an update is not immediately available, administrators should restrict access to the management interface by placing it behind strong authentication mechanisms and network segmentation policies such as VLANs or firewalls to limit exposure to untrusted networks. Additionally, input validation must be enforced at all entry points; specifically, any file upload functionality that processes archives containing symlinks requires rigorous sanitization of symlink targets before they are passed to system commands. Implementing strict allow-lists for acceptable characters in filenames and ensuring proper quoting of variables within shell scripts are essential defensive coding practices to prevent similar injection attacks in the future.