CVE-2025-26056

MEDIUM

Infinxt iEdge 100 2.1.32 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-26056. PoCs published by rohan-pt.

AI-analyzed exploit summary This repository provides a writeup for CVE-2025-26056, detailing an OS command injection vulnerability in an unspecified web application. The PoC describes a method to exploit the vulnerability via a specific endpoint and parameter manipulation.

Description

A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the mtrIp parameter. An attacker can exploit this flaw to execute arbitrary operating system commands on the underlying system with the same privileges as the web application process.

Exploits (1)

nomisec WRITEUP
by rohan-pt · poc
https://github.com/rohan-pt/CVE-2025-26056

This repository provides a writeup for CVE-2025-26056, detailing an OS command injection vulnerability in an unspecified web application. The PoC describes a method to exploit the vulnerability via a specific endpoint and parameter manipulation.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: unspecified web application
Auth required
Prerequisites: access to the web application · valid credentials · Burp Suite or similar tool for request manipulation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 5.4
EPSS 0.0101
EPSS Percentile 58.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-77
Status published
Published Apr 01, 2025
Tracked Since Feb 18, 2026