Xovis AG CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Xovis AG CVE published 2026-10-26

CVE-2026-36698

The CVE-2026-36698 vulnerability is an OS command injection issue in Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier. The vulnerability is located in the /sbin/ImportParamSet.sh script, which processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. This allows for arbitrary comma [truncated]