Zero Radar
← feed
CriticalVulnerabilityCVE-2026-79858updated 25 Oct 2026, 16:50 UTC

AOS-8 network devices can be hacked remotely via their PAPI protocol

Someone on the network, with no password, could send specially crafted messages to the device and read or change its stored data, or knock the service offline. The flaw is in how the device handles input to its database.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or credentials needed
  2. 2PAPI requestCrafted input sent over the network
  3. 3SQL injectionInput is run as database commands
  4. 4Data exposedSensitive records read or changed
  5. 5Service disruptedNormal operation interrupted
  6. ResultAttacker reads, alters data, or disrupts service

What happened

An unauthenticated SQL injection flaw exists in the PAPI protocol of AOS-8, allowing remote attackers to read and modify data in the underlying database and disrupt the service.

Why it is dangerous: An attacker can obtain and alter sensitive information without logging in and can interrupt normal operation of the affected service, giving them a serious foothold on the device.

Are you affected?

You are affected if you run an AOS-8 deployment with the PAPI protocol reachable over the network.

AOS-8 (specific versions not stated in the provided material)

What to do

  1. Check whether your AOS-8 devices expose the PAPI protocol to untrusted networks and restrict access to it now.
  2. Check the vendor's advisory for the patched AOS-8 version and update affected devices as soon as a fix is available.
  3. Review device logs for unusual database-related or PAPI requests from unexpected sources.

Timeline

  1. 22 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-79858 · GHSA-p4m6-7h53-f97f
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 19:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AOS-8 network devices can be hacked remotely via their PAPI protocol · Zero Radar