{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cveId":"CVE-2026-36698","cwes":["CWE-78"],"description":"Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.","epss":{"date":"2026-11-02","percentile":0.43174,"score":0.00505},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793636260860,"publishedAt":1792972800000,"references":[{"source":"CNA: mitre","tags":[],"url":"http://xovis.com/"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md"},{"source":"cve@mitre.org","tags":[],"url":"http://xovis.com/"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md"}],"remediation":[],"revision":"445a3cb8a5f1072e0a3658aacb1769f265a11c1099cfb7a4d5ea399ce913cbe3","sources":[{"modifiedAt":1793634709644,"name":"CNA: mitre","retrievedAt":1793635756486,"url":"https://www.cve.org/CVERecord?id=CVE-2026-36698"},{"modifiedAt":1793636260860,"name":"NVD","retrievedAt":1793643441971,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-36698"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793635765878,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-36698"}],"ssvc":{"assessedAt":1793634617757,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-36698","updatedAt":1793643441971}