CVE-2026-2533
HIGHTosei Self-service Washing Machine 4.02 - Command Injection
Title source: llmDescription
A flaw has been found in Tosei Self-service Washing Machine 4.02. Impacted is an unknown function of the file /cgi-bin/tosei_datasend.php. Executing a manipulation of the argument adr_txt_1 can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References (4)
Core 4
Core References
Permissions Required, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.346121
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.346121
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.748771
Various Sources exploit
https://www.yuque.com/yuqueyonghuexlgkz/zepczx/depg9z4c5b1t4mgd
Scores
CVSS v3
7.3
EPSS
0.0168
EPSS Percentile
73.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
CWE-77
Status
published
Products (1)
Tosei/Self-service Washing Machine
4.02
Published
Feb 16, 2026
Tracked Since
Feb 18, 2026