# CVE-2026-82971: QVidium Opera11 command injection in net_tr.cgi

Source: https://junglewise.ai/threats/cve-2026-82971-qvidium-opera11-command-injection-in-net-tr-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82971 · Severity: critical · CVSS 10 · Published 2026-08-31

QVidium Opera11 is a network device management interface. The product contains a command injection vulnerability in its CGI script (/cgi-bin/net_tr.cgi) that allows remote attackers to execute arbitrary system commands. Since QVidium ceased operations and no longer provides support or patches, affected devices remain vulnerable.

## Quick answers

**Is CVE-2026-82971 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82971 being exploited in the wild.

**How severe is CVE-2026-82971?** Critical severity, with a CVSS score of 10, published 31 August 2026.

**Which products and versions are affected?** QVidium Opera11 3.3.2a26-Ax4x-opera11.

**Is there a fix for CVE-2026-82971?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82971 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82971?** Check whether you run QVidium Opera11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw in the /cgi-bin/net_tr.cgi CGI script where the ipaddr parameter is not properly sanitized before being used in a system command. An unauthenticated remote attacker can send a crafted HTTP request to the vulnerable endpoint with malicious input in the ipaddr argument to achieve arbitrary command execution with the privileges of the web server process. The attack vector is network-based and requires no authentication. Exploitation is straightforward and proof-of-concept code has been publicly disclosed. The vendor (QVidium) has ceased operations and will not release patches or provide support.

## Affected products

- QVidium Opera11 3.3.2a26-Ax4x-opera11

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: advisory: Public disclosure announced

## References

- [https://uvxbywu62qm.feishu.cn/wiki/Tn2ewwaafigfabkMWJJcc3rhnud?from=from_copylink](https://uvxbywu62qm.feishu.cn/wiki/Tn2ewwaafigfabkMWJJcc3rhnud?from=from_copylink)
- [https://vuldb.com/cve/CVE-2026-82971](https://vuldb.com/cve/CVE-2026-82971)