CVE-2026-78797 in iStoreOS
Summary
by MITRE • 10/09/2026
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified involves a critical Remote Code Execution (RCE) flaw within the iStoreOS software, specifically affecting versions 24.10.7 and earlier releases. This security defect resides in the file named tasks-lib.lua, which is part of the system's task management or background job processing library. The core technical issue stems from insufficient input validation regarding the task_id parameter passed to this module. When a remote attacker interacts with the application interface that utilizes this library, they can inject malicious payloads directly into the task_id field. Because the underlying Lua script likely executes commands or processes based on this identifier without proper sanitization, the injected code is interpreted and executed by the system context in which iStoreOS operates. This represents a classic injection vulnerability where user-supplied data is treated as executable logic rather than inert data.
From an operational perspective, the impact of this vulnerability is severe due to its remote nature and the potential for arbitrary code execution. An attacker does not necessarily need valid credentials if the affected endpoint or API call associated with tasks-lib.lua is accessible over the network without authentication, or even if it requires low-privilege access that allows task submission. Successful exploitation grants the adversary full control over the underlying operating system processes running iStoreOS. This can lead to a complete compromise of the device's confidentiality, integrity, and availability. The attacker could install backdoors, exfiltrate sensitive data stored on the router or gateway, pivot into internal network segments, or use the compromised device as part of a botnet for distributed denial-of-service attacks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-94, which describes Improper Control of Generation of Code ('Code Injection'). It also maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques such as T1059.007 for Lua scripting if the environment supports it natively or through interpreted execution contexts. The attack vector is classified under Remote Code Execution (RCE), allowing exploitation from across a network boundary without requiring physical access to the device.
Mitigation strategies must focus on immediate patching and defensive configuration changes. Users should upgrade iStoreOS to version 24.10.8 or any later release where this input validation flaw has been addressed by the developers. In scenarios where upgrading is not immediately feasible, network-level controls such as firewall rules restricting access to the management interface from untrusted networks can reduce exposure. Additionally, implementing strict input sanitization on all parameters passed to Lua scripts that execute system commands is essential for long-term security hygiene. Security teams should monitor logs for unusual command execution patterns or unexpected outbound connections originating from iStoreOS devices to detect potential exploitation attempts in real-time.