Description
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-01
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the ArmAngstromInstructionSet function of the /CGI?RestApi=SetHostname endpoint allows an attacker to inject and execute arbitrary system commands. This command injection can compromise confidentiality, integrity, and availability of the target device, leading to full compromise of the affected system. The weakness involves improper handling of the ParameterArray argument and unsafe command construction, as described by CWE-74 and CWE-77.

Affected Systems

Affected products are ICP DAS UA‑2200 and UA‑5200 firmware versions up to 20260704. No other versions or products are listed as vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS data is not available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack can be performed remotely, and published exploits exist, meaning an adversary could remotely trigger the command injection without local access.

Generated by OpenCVE AI on September 1, 2026 at 12:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor–supplied firmware update or patch that eliminates the vulnerable ArmAngstromInstructionSet code or applies proper sanitization.
  • Disable the /CGI?RestApi=SetHostname endpoint or restrict its use to trusted hosts through network ACLs or firewall rules if a patch is unavailable.
  • Implement input validation and sanitization on the ParameterArray parameter to prevent malicious command construction when an official fix cannot be applied immediately.

Generated by OpenCVE AI on September 1, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
First Time appeared Icp Das
Icp Das ua-2200
Icp Das ua-5200
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:icp_das:ua-2200:*:*:*:*:*:*:*:*
cpe:2.3:a:icp_das:ua-5200:*:*:*:*:*:*:*:*
Vendors & Products Icp Das
Icp Das ua-2200
Icp Das ua-5200
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Icp Das Ua-2200 Ua-5200
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-01T10:45:40.216Z

Reserved: 2026-09-01T05:26:20.744Z

Link: CVE-2026-84059

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-01T11:16:45.493

Modified: 2026-09-01T11:16:45.493

Link: CVE-2026-84059

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T12:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')