Command Injection in /index.php/ajax/parameterManage Endpoint

CVE-2026-27551 is a command injection vulnerability discovered in the /index.php/ajax/parameterManage endpoint of an affected web-based management interface. The vulnerability allows a remote attacker who possesses low-privileged user credentials to bypass intended security controls and execute arbitrary system commands with root-level privileges on the underlying device. This flaw presents a significant security risk, as it effectively enables full device compromise once initial access has been achieved via the required user account. The vulnerability has been assigned a CVSS v3.1 base score of 8.8, reflecting its high impact and the relative ease of exploitation for an authenticated user. Organizations utilizing devices with this vulnerable AJAX endpoint should prioritize implementing vendor-supplied patches or restricting access to the management interface.

Impact

Successful exploitation results in full remote code execution with root privileges on the affected hardware. This allows attackers to install persistent backdoors, exfiltrate sensitive configuration data, or leverage the device as a pivot point for further lateral movement within the network.

Recommendation

Prioritize patching all internet-facing management interfaces that utilize the /index.php/ajax/parameterManage endpoint. Monitor web server access logs for anomalous POST requests directed at this specific URI, particularly those containing shell metacharacters or encoded commands.