CVE-2026-36356

Critical severity, CVSS 9.1. EPSS: 3.6% chance of exploitation in the next 30 days.

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.

Published 2026-05-05. Last modified 2026-07-05.