TI-2026-21204 CVE-2026-26213 · GHSA-h56g-w4h5-4239thingino-firmware api.cgi Unauthenticated Command Injection in Captive PortalPriority MEDIUM 47thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticated os command injection vulnerability in the WiFi captive portal CGI script that allows remote attackers to execute arbitrary comm…CVSS 4.0HIGH 8.7· Adjacent network · No auth · No interaction · EPSS 0.04667 · Published 2026-03-26 · No fix listed CWE-78
