VYPR

PAP-XM320

by Pan

CVEs (3)

  • CVE-2026-36829CriMay 19, 2026
    risk 0.64cvss 9.8epss 0.00

    An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.

  • CVE-2026-36828HigMay 19, 2026
    risk 0.57cvss 8.8epss 0.00

    A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.

  • CVE-2026-36827MedMay 19, 2026
    risk 0.35cvss 5.4epss 0.00

    A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.