CVE-2023-26921
9.8
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.69% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2023-04-04 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| quectel | ag550qcn |
| quectel | ag550qcn firmware |
References
→ the Explorer · watch your stack · NVD