Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subseq…

CVE-2026-7849 describes a critical command injection vulnerability caused by improper neutralization of special elements in system configuration. An unauthenticated remote attacker can inject arbitrary commands that are subsequently executed with root privileges. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. The flaw is documented by both NVD and CERT VDE. Successful exploitation could result in full system compromise. The issue is classified as high severity due to the combination of remote access, no authentication requirement, and root-level code execution.