thingino-firmware versions up to firmware-2026-03-16 contain an unauthenticated OS command injection flaw in the WiFi captive‑portal CGI script. The vulnerability arises because suspicious HTTP parameter names are passed directly to the eval function in parse_query() and parse_post(). An attacker can inject arbitrary shell commands that are executed with root privileges, enabling full device compromise, password resets, and modification of authorized_keys.

The affected systems are devices running themactep:thingino‑firmware, specifically any firmware build up to and including firmware-2026-03-16.

With a CVSS score of 8.7 the vulnerability presents a high severity. The exploitation requires only unauthenticated HTTP access to the captive‑portal endpoint, making it easily targetable over the wireless network. Although EPSS data is unavailable and the flaw is not in the CISA KEV list, the combination of local network exposure and root‑level execution makes this a serious threat if left unpatched.