CVE-2026-23678 describes a critical command injection vulnerability in Binardat 10G08-0800GSM network switch firmware versions V300SP10260209 and prior. An authenticated attacker can exploit a flaw in the traceroute function's hostname parameter via the web management interface to execute arbitrary CLI commands. This vulnerability carries a CVSS score of 8.8 (High), indicating a severe impact with high confidentiality, integrity, and availability compromise, requiring only low privileges and no user interaction. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, though it has received some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= V300SP10260209CPE matchmatch criteria | cpe:2.3:o:binardat:10g08-0800gsm_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.