CVE-2026-84409

What it is

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content. In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. An attacker able to influence update metadata could exploit these conditions to execute arbitrary code within the administrative context of the device.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-29 22:19 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-30 16:46 UTC Last updatedMost recent change to the record

Details

Published

2026-09-29 22:19 UTC

Last modified

2026-09-30 16:46 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 7.7

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

None

User interaction

Passive

Confidentiality

High

Integrity

High

Availability

High