Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by VulDB

CVE-2026-83772Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

Critical 9.9

In plain English

A critical-severity command injection in SATCOM VSAT7090 Maritime Satellite Router from Cobham. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)3.2%top 11.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
Cobham SATCOM VSAT7090 Maritime Satellite Router 20260704

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References