Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-7849

Command Injection in SCM (idledisconnect parameter)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Phoenix Contact CHARX SEC-3150

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3100

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3050

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3000

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

References