Read the docs
TI-2026-19132 Aliases CVE-2026-23759GHSA-rcw4-cmhr-ggx7

Perle IOLAN STS/SCS Authenticated Command Injection via 'shell ps'

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c' invocation running as root. An authenticated attacker who can log in to the device can inject shell metacharacters after the 'ps' subcommand to execute arbitrary OS commands with root privileges, leading to full compromise of the underlying operating system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01603 75th percentileScored 2026-11-07
Fix Fixed IOLAN STS (Perle Systems): 6.0IOLAN SCS (Perle Systems): 6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Perle SystemsIOLAN STSbefore 6.06.0Patch availableCNA
Perle SystemsIOLAN SCSbefore 6.06.0Patch availableCNA
  • IOLAN STS VendorPerle Systems Affected before 6.0 Fixed in 6.0 Patch available CNA
  • IOLAN SCS VendorPerle Systems Affected before 6.0 Fixed in 6.0 Patch available CNA

Remediation

  • Fix · CNA IOLAN STS (Perle Systems) Fixed in 6.0
  • Fix · CNA IOLAN SCS (Perle Systems) Fixed in 6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23759
  2. 2026-10-03 Alias added: GHSA-rcw4-cmhr-ggx7

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences