{"id":"CVE-2026-36698","published":"2026-10-26T15:16:40.710","lastModified":"2026-10-26T18:41:21.450","description":"Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"http://xovis.com","tags":[]},{"url":"https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md","tags":[]}],"hasPoc":true,"ai":null}