OS command injection in TR7 Cyber Defense TR7 ASP
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
TR7 Cyber Defense Inc. TR7 ASP on virtual and physical appliances is affected from 1.0.40.236 before 1.0.1554.2331 and from 1.6.42.239 before 1.6.1554.2331. Improper neutralization of special elements in an OS command (CWE-78) lets attacker-supplied input reach operating system commands. An unauthenticated remote attacker can inject OS commands, with high impact to confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TR7 Cyber Defense Inc. | TR7 ASP | 1.0.40.236 to before 1.0.1554.2331 | 1.0.1554.2331 | Patch available | CNA |
| TR7 Cyber Defense Inc. | TR7 ASP | 1.6.42.239 to before 1.6.1554.2331 | 1.6.1554.2331 | Patch available | CNA |
- TR7 ASP VendorTR7 Cyber Defense Inc. Affected 1.0.40.236 to before 1.0.1554.2331 Fixed in 1.0.1554.2331 Patch available CNA
- TR7 ASP VendorTR7 Cyber Defense Inc. Affected 1.6.42.239 to before 1.6.1554.2331 Fixed in 1.6.1554.2331 Patch available CNA
Remediation
Upgrade TR7 ASP to 1.0.1554.2331 for the first affected range and to 1.6.1554.2331 for the second.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA TR7 ASP (TR7 Cyber Defense Inc.) Fixed in 1.0.1554.2331
- Fix · CNA TR7 ASP (TR7 Cyber Defense Inc.) Fixed in 1.6.1554.2331
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
TR7 ASP 1.0.1554.2331, 1.6.1554.2331
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-73908 TR7 ASP lacks authentication, allowing OS command injectionPriority MEDIUM 52
Timeline
- 2026-10-14 Threatist record created from CVE-2026-16741
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Alias added: GHSA-rr7g-59r8-56c5
References
More TR7 Cyber Defense Inc. vulnerabilities
- TI-2026-73908 TR7 ASP lacks authentication, allowing OS command injection CVSS 3.1CRITICAL 9.8
- TI-2026-04159 Improper Access Control in TR7's WAF-ASP CVSS 3.1CRITICAL 9.8
- TI-2026-04162 Stored XSS in TR7's WAF-ASP CVSS 3.1MEDIUM 5.4
- TI-2026-04161 DOM-Based XSS in TR7's WAF-ASP CVSS 3.1MEDIUM 4.6
- TI-2025-02132 Open Redirect in TR7's Web Application Firewall CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-16741 · CVE Program
- CVE-2026-16741 · NVD
- FIRST EPSS
- GHSA-rr7g-59r8-56c5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences