CVE-2026-36827

Vulnerability

A command injection vulnerability exists in the web management interface of Panabit PAP-XM320 up to and including V7.7 [1]. The backend helper /usr/sbin/pappiw is invoked with user-controlled parameters, and it performs unsafe argument processing using eval, which allows arbitrary command injection [1].

Exploitation

An authenticated attacker with access to the management interface can inject shell metacharacters into the parameters passed to pappiw; the helper passes these arguments through eval, enabling arbitrary command execution. No special network position beyond the management interface is required, but valid credentials are necessary [1].

Impact

Successful exploitation allows the attacker to execute arbitrary shell commands on the underlying operating system with the privileges of the vulnerable helper process. This can lead to full compromise of the device's confidentiality, integrity, and availability [1].

Mitigation

Panabit has not yet released a patched version as of the publication date (2026-05-19). The vendor advisory [1] does not describe any workaround. Users should monitor vendor communications and restrict access to the management interface to trusted networks and accounts [1].