CVE-2021-26731

CVE-2021-26731 describes critical command injection and multiple stack-based buffer overflow vulnerabilities in the modifyUserb_func function of Lanner Inc IAC-AST2500A standard firmware version 1.10.0. An authenticated attacker can exploit these flaws to execute arbitrary code with root privileges. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential interest.