Executive brief
thingino-firmware is an open-source firmware used for IP cameras and IoT devices. A security flaw in its WiFi captive portal allows an unauthorized person to take complete control of the device over the network. An attacker could use this to change the administrator password, access private video feeds, or permanently compromise the device's security.
Technical details
An OS command injection vulnerability exists in the WiFi captive portal CGI script of thingino-firmware. The root cause is the improper use of the 'eval' function within the parse_query() and parse_post() functions, which fails to sanitize HTTP parameter names. An unauthenticated remote attacker can inject malicious code through these parameters to execute arbitrary commands with root privileges. This can lead to persistent compromise, including the ability to reset the root password or modify SSH authorized_keys. The vulnerability is present in versions up to the firmware-2026-03-16 release.
Affected products
- thingino thingino-firmware up to and including firmware-2026-03-16
Timeline
- 2026-03-15: patched: Firmware release 2026-03-15 addressed related components; advisory suggests versions up to 2026-03-16 are affected.
- 2026-03-26: disclosed
- 2026-03-26: advisory