CVE-2026-84059 - Vulnerability Details

- ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection

Description

A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-01

Score: 5.3 Medium

EPSS: 1.6% Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the ArmAngstromInstructionSet function of the /CGI?RestApi=SetHostname endpoint allows an attacker to inject and execute arbitrary system commands. This command injection can compromise confidentiality, integrity, and availability of the target device, leading to full compromise of the affected system. The weakness involves improper handling of the ParameterArray argument and unsafe command construction, as described by CWE-74 and CWE-77.

Affected Systems

Affected products are ICP DAS UA‑2200 and UA‑5200 firmware versions up to 20260704. No other versions or products are listed as vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS score is 2% and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack can be performed remotely, and published exploits exist, meaning an adversary could remotely trigger the command injection without local access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ICP DAS

UA-2200

affected

Version	Status	Constraints
`20260704`	affected	—

ICP DAS

UA-5200

affected

Version	Status	Constraints
`20260704`	affected	—

No data.

Vendor Product Confidence Versions

Icp Das

Ua-2200

100%

Version	Status	Scheme	Platform
`20260704`	affected	generic	—

Icp Das

Ua-5200

100%

Version	Status	Scheme	Platform
`20260704`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a vendor–supplied firmware update or patch that eliminates the vulnerable ArmAngstromInstructionSet code or applies proper sanitization.
Disable the /CGI?RestApi=SetHostname endpoint or restrict its use to trusted hosts through network ACLs or firewall rules if a patch is unavailable.
Implement input validation and sanitization on the ParameterArray parameter to prevent malicious command construction when an official fix cannot be applied immediately.

Generated by OpenCVE AI on September 2, 2026 at 14:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01568.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://uvxbywu62qm.feishu.cn/wiki/KwSzwcCstioZqKk7PODcIsDAn4W?from=from_copylink
https://uvxbywu62qm.feishu.cn/wiki/SzRyw0uSnieCLDkMR8NcgcvanMd?from=from_copylink
https://vuldb.com/cve/CVE-2026-84059
https://vuldb.com/submit/880065
https://vuldb.com/submit/880072
https://vuldb.com/vuln/397547
https://vuldb.com/vuln/397547/cti

History

Wed, 02 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 11:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
First Time appeared		Icp Das Icp Das ua-2200 Icp Das ua-5200
Weaknesses		CWE-74 CWE-77
CPEs		cpe:2.3:a:icp_das:ua-2200:::::::: cpe:2.3:a:icp_das:ua-5200::::::::
Vendors & Products		Icp Das Icp Das ua-2200 Icp Das ua-5200
References		https://uvxbywu62qm.feishu.cn/wiki/KwSzwcCstioZqKk7PODcIsDAn4W?from=from_copylink https://uvxbywu62qm.feishu.cn/wiki/SzRyw0uSnieCLDkMR8NcgcvanMd?from=from_copylink https://vuldb.com/cve/CVE-2026-84059 https://vuldb.com/submit/880065 https://vuldb.com/submit/880072 https://vuldb.com/vuln/397547 https://vuldb.com/vuln/397547/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}`

Subscriptions

Icp Das Ua-2200 Ua-5200

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-01T10:45:40.216Z

Updated: 2026-09-01T18:10:27.996Z

Reserved: 2026-09-01T05:26:20.744Z

Link: CVE-2026-84059

Vulnrichment

Updated: 2026-09-01T17:14:20.185Z

NVD

Status : Deferred

Published: 2026-09-01T11:16:45.493

Modified: 2026-09-01T20:47:54.130

Link: CVE-2026-84059

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-02T14:45:05Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object