TI-2026-57727 Aliases CVE-2026-83772 GHSA-27pg-4jfx-cpx7

Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

HIGH 76CWE-74Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03212 88th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cobham plc	SATCOM VSAT7090 Maritime Satellite Router	20260704	—	No fix listed	CNA

SATCOM VSAT7090 Maritime Satellite Router VendorCobham plc Affected 20260704 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:cobham:satcom_vsat7090_maritime_satellite_router::::::::	—	—	Cobham plc

cpe:2.3:h:cobham:satcom_vsat7090_maritime_satellite_router:*:*:*:*:*:*:*:* Versions — — ·Cobham plc

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-83772
2026-10-03 Alias added: GHSA-27pg-4jfx-cpx7

References

Exploit 1

https://uvxbywu62qm.feishu.cn/wiki/ERgywyUVfiUM2lkfVLwc1swknXg?from=from_copylink

TI-2023-24031 Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a… CVSS 3.1MEDIUM 6.5
TI-2023-24029 \An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to… CVSS 3.1MEDIUM 4.8
TI-2019-06956 Improper access control in Cobham plc Explorer 710 CVSS 3.1CRITICAL 9.8
TI-2018-03820 Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication… CVSS 3.0CRITICAL 9.8
TI-2014-02356 Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have… CVSS 2.0HIGH 10.0
TI-2019-06958 Insufficiently protected credentials in Cobham plc Explorer 710 CVSS 3.1CRITICAL 9.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences