CVE-2026-36827

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.

Published 2026-05-19. Last modified 2026-07-24.