CVE-2026-23678
Published: 24 February 2026
Description
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access…
more
to the web interface can execute arbitrary CLI commands on the device.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of untrusted inputs like the hostname parameter in the traceroute function to block command injection exploits.
Mandates timely remediation of identified flaws, such as patching the firmware vulnerability enabling arbitrary CLI command execution.
Enforces least functionality by prohibiting or restricting unnecessary diagnostic features like the vulnerable traceroute function in the web interface.
Security SummaryAI
CVE-2026-23678 is a command injection vulnerability (CWE-78) in the traceroute diagnostic function of the web management interface on Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior. Published on 2026-02-24, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An authenticated attacker with access to the web management interface can exploit the vulnerability remotely by injecting the %1a character into the hostname parameter during traceroute execution. This allows the attacker to run arbitrary CLI commands on the underlying device, enabling full control over the switch's operations.
Mitigation guidance is available in advisories and vendor resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-traceroute-cli-command-injection and the Binardat product page at https://www.binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables command injection in web management interface, directly facilitating Network Device CLI execution (T1059.008) and exploitation of a public-facing web application (T1190).