CVE-2026-23678
Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access to the web interface can execute arbitrary CLI commands on the device.
| CWE | CWE-78 |
| Vendor | binardat ltd. |
| Product | 10g08-0800gsm network switch |
| Published | Feb 24, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for binardat ltd. 10g08-0800gsm network switch
Be the first to know when new high vulnerabilities affecting binardat ltd. 10g08-0800gsm network switch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Binardat Ltd. / 10G08-0800GSM Network Switch
0 ≤ V300SP10260209
References
binardat.com: https://www.binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch vulncheck.com: https://www.vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-traceroute-cli-command-injection
Credits
Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.