{"id":"CVE-2026-16741","published":"2026-10-14T13:17:28.103","lastModified":"2026-10-15T14:42:22.220","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1327","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject arbitrary OS commands through the TR7 ASP platform, potentially leading to complete system compromise. The flaw exists in both virtual and physical appliance deployments.","exploitability":"Exploitation is relatively straightforward with no authentication required, allowing remote attackers to execute arbitrary commands with the privileges of the affected service.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over the TR7 appliance, potentially leading to data breaches, lateral movement, or complete system takeover across affected deployments.","remediation":"Upgrade to TR7 ASP version 1.0.1554.2331 or 1.6.1554.2331 to remediate this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","network-security","ics"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:43.701Z"}}