Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subseq…

CVE-2026-7849 describes a critical command injection vulnerability caused by improper neutralization of special elements in system configuration. An unauthenticated remote attacker can exploit this flaw to inject arbitrary commands into the system configuration, which are then executed with root privileges. No authentication is required, making this exploitable by any remote attacker. The vulnerability is documented by both NVD/NIST and CERT VDE. The severity is rated High due to the potential for full system compromise. Successful exploitation could lead to complete control of the affected system. The advisory VDE-2026-008 from CERT VDE provides additional details on affected products and mitigations.