CVE-2026-16740
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can execute arbitrary OS commands and fully compromise the appliance over the network. No credentials or user interaction are required.
Root cause
Critical appliance functions lack authentication checks, allowing unauthenticated requests to inject and run OS commands.
Affected systems
TR7 ASP on virtual and physical appliances: 1.0.40.236 before 1.0.1554.2331, and 1.6.42.239 before 1.6.1554.2331.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade TR7 ASP to version 1.0.1554.2331 or 1.6.1554.2331 or later. If updating immediately is not possible, restrict network access to the appliance management interface via firewall rules or ACLs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.