thingino-firmware versions up to firmware-2026-03-16 contain an unauthenticated OS command injection flaw (CWE-78) in the WiFi captive‑portal CGI script. The vulnerability arises because suspicious HTTP parameter names are passed directly to the eval function in parse_query() and parse_post(). An attacker can inject arbitrary shell commands that are executed with root privileges, enabling full device compromise, password resets, and modification of authorized_keys.

The affected systems are devices running themactep:thingino-firmware, specifically any firmware build up to and including firmware-2026-03-16.

With a CVSS score of 8.7 the vulnerability presents a high severity. The exploitation requires only unauthenticated HTTP access to the captive‑portal endpoint, making it easily targetable over the wireless network. An EPSS score of 6% indicates a moderate likelihood of exploitation, and the flaw is not in the CISA KEV list; the combination of local network exposure and root‑level execution still makes this a serious threat if left unpatched.