Description
NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.
Published: 2026-08-05
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated attacker can exploit an Unquoted Search Path flaw (CWE-428) in NetKids iMark to launch arbitrary code with SYSTEM privileges, giving full control over the device and compromising confidentiality, integrity, and availability.

Affected Systems

The vendor Integrated Systems Technologies, Inc. supplies the NetKids iMark product. No version information has been disclosed, so all released versions should be considered potentially vulnerable until a fix is deployed.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, reflecting a high impact. EPSS data is not available, and the flaw is not listed in CISA KEV. Exploitation requires authenticated access, likely through legitimate credentials, after which the attacker can manipulate the unquoted search path to execute system binaries with full privileges.

Generated by OpenCVE AI on August 5, 2026 at 06:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor’s website or security portal for an update that patches the unquoted search path issue in NetKids iMark and install it immediately.
  • Limit access to the NetKids iMark system by restricting authenticated users to trusted staff and enforcing strong passwords or multi-factor authentication.
  • Ensure that all executable calls use fully qualified paths and that the system PATH does not include untrusted directories, thereby preventing the unquoted search path vulnerability.

Generated by OpenCVE AI on August 5, 2026 at 06:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Integrated Systems Technologies, Inc.
Integrated Systems Technologies, Inc. netkids Imark
Vendors & Products Integrated Systems Technologies, Inc.
Integrated Systems Technologies, Inc. netkids Imark

Wed, 05 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Authenticated Arbitrary Code Execution via Unquoted Search Path in NetKids iMark

Wed, 05 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Description NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.
Weaknesses CWE-428
References
Metrics cvssV3_0

{'score': 6.7, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Integrated Systems Technologies, Inc. Netkids Imark
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-08-05T04:26:13.962Z

Reserved: 2026-07-28T05:10:33.727Z

Link: CVE-2026-66839

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:18:35Z

Weaknesses
  • CWE-428

    Unquoted Search Path or Element