CVE-2026-16741
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Unauthenticated remote attackers can execute arbitrary OS commands and fully compromise the appliance over the network. They require no credentials or user interaction.
Root cause
Improper input sanitization allows user-supplied parameters to escape into underlying operating system commands.
Affected systems
TR7 ASP physical and virtual appliances: 1.0.40.236 up to (but excluding) 1.0.1554.2331, and 1.6.42.239 up to (but excluding) 1.6.1554.2331.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade TR7 ASP to version 1.0.1554.2331, 1.6.1554.2331, or later. If upgrading immediately is not possible, restrict or block network access to appliance management interfaces from untrusted networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.