CVE-2026-82971
QVidium Opera11 CGI Script net_tr.cgi command injection
- State
- Published
- Severity
- 10.0 Critical
- Published
- Aug 31, 2026
- Updated
- Sep 1, 2026
- Reserved
- Aug 31, 2026
Description
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 10.0 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 10.0 High | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Opera11QVidium |
|
References
- VDB-397334 | QVidium Opera11 CGI Script net_tr.cgi command injectionvdb-entrytechnical-description
- VDB-397334 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-82971 | CVE Analysis and Reportthird-party-advisory
- Submit #880050 | QVidium QVidium Opera11 3.3.2a26-Ax4x-opera11 Command Injectionthird-party-advisory
- https://uvxbywu62qm.feishu.cn/wiki/Tn2ewwaafigfabkMWJJcc3rhnud?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.