CVE-2026-2686
SECCN Dingcheng G10 session_login.cgi qq os command injection
- State
- Published
- Severity
- 9.3 Critical
- Published
- Feb 19, 2026
- Updated
- Feb 24, 2026
- Reserved
- Feb 18, 2026
Description
A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R | VulDB |
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R | VulDB |
| 2.0 | 10.0 High | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
G10SECCN Dingcheng |
|
References
- VDB-346488 | SECCN Dingcheng G10 session_login.cgi qq os command injectionvdb-entrytechnical-description
- VDB-346488 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #754200 | SECCN SECCN G10 VPN V3.1.0.181203 Unauthorized RCEthird-party-advisory
- https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.mdrelated
- https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md#2-vulnerability-reproduction-proof-of-conceptexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.