CVE-2026-20892

Vulnerability

Description

CVE-2026-20892 is a code injection vulnerability (CWE-94) in Micro Research MR-GM5L-S1 and MR-GM5A-L1 devices. The flaw exists in firmware versions prior to v2.01.04N1_02. An attacker with administrative privileges can inject and execute arbitrary commands due to insufficient input validation [1].

Exploitation

Conditions

Exploitation requires administrative privileges to the device's management interface. No user interaction is needed. The attack vector is network-based, with low attack complexity [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with the same privileges as the device firmware, potentially leading to full compromise of the device. The CVSS v3 base score is 7.2 (High), with impacts to confidentiality, integrity, and availability all rated as High [1].

Mitigation

Micro Research recommends updating the firmware to version v2.01.04N1_02 or later [1]. The vendor advisory provides this update as the only solution. No workarounds are mentioned.

_Note: The same advisory also discloses two other vulnerabilities in the same products (CVE-2026-24448 and CVE-2026-27842) that are not covered in this analysis._