Vulnerabilidades de Qvidium
CVEs publicadas que afetam produtos de Qvidium: 2 registro(s), com severidade, exploração e correções.
CVE-2026-82971
Crítica · 10.0
CWE-74 31/08/2026
QVidium Opera11 CGI Script net_tr.cgi command injection
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-63213
Crítica · 9.8
CWE-20 19/11/2025
Improper Input Validation em Qvidium Opera11 Firmware
The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary commands. These commands are executed with root privileges, allowing attackers to gain full control over the device. This poses a significant security risk to any device running this software.