Binardat 10G08‑0800GSM network switches have a command injection flaw in the traceroute diagnostic function of the web management interface. By inserting the special character %1a into the hostname field, an attacker who has authenticated access can execute arbitrary command‑line instructions on the device. This grants the attacker full control over the switch, jeopardizing confidentiality, integrity, and availability. The vulnerability is classified as CWE‑78.

The flaw affects Binardat Ltd.’s 10G08‑0800GSM network switch, firmware version V300SP10260209 and all earlier releases. The exposed component is the traceroute diagnostic operation in the switch’s web interface.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the web interface, so credential compromise or social engineering is a prerequisite. Once that is achieved, the injection is straightforward and can lead to unrestricted remote code execution.