CVE-2026-84059
ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 1, 2026
- Updated
- Sep 1, 2026
- Reserved
- Sep 1, 2026
Description
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P | VulDB |
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.4 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
UA-2200ICP DAS |
|
UA-5200ICP DAS |
|
References
- VDB-397547 | ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injectionvdb-entrytechnical-description
- VDB-397547 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-84059 | CVE Analysis and Reportthird-party-advisory
- Submit #880065 | ICP DAS UA‑2200 Series UA‑2200 Series Command Injectionthird-party-advisory
- Submit #880072 | ICP DAS UA‑5200 Series UA‑5200 Series Command Injection (Duplicate)third-party-advisory
- https://uvxbywu62qm.feishu.cn/wiki/SzRyw0uSnieCLDkMR8NcgcvanMd?from=from_copylinkrelated
- https://uvxbywu62qm.feishu.cn/wiki/KwSzwcCstioZqKk7PODcIsDAn4W?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.