{"id":"CVE-2026-16740","published":"2026-10-14T13:17:27.977","lastModified":"2026-10-15T14:42:22.220","description":"Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1327","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated OS command injection in TR7 ASP on both virtual and physical appliances, enabling attackers to execute arbitrary commands with high privileges. The flaw affects versions before 1.0.1554.2331 and 1.6.1554.2331 respectively.","exploitability":"Exploitation is straightforward with no authentication required, allowing immediate command injection via network access to the affected appliance.","blast_radius":"An attacker could gain full system control of the appliance, potentially leading to complete network compromise through lateral movement and privilege escalation.","remediation":"Upgrade to version 1.0.1554.2331 or 1.6.1554.2331 for the respective appliance types.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","ics","authentication-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:35.710Z"}}