CVE-2026-63586

Name of the Vulnerable Software and Affected Versions Weidmueller router (affected versions not specified)

Description The web-based management interface utilizes a modified uhttpd server with CGI shell scripts. The system fails to sanitize the HTTP Basic Authentication username retrieved from the Authorization header before inserting it into a shell command string executed via the system() function. An unauthenticated attacker with network access can provide a specially crafted username containing shell metacharacters to escape the command context and execute arbitrary commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.