CVE-2026-82971

QVidium Opera11 version 3.3.2a26-Ax4x-opera11 contains a command injection flaw in the CGI script /cgi-bin/net_tr.cgi, where the 'ipaddr' argument is passed to the system without proper sanitization (CWE-74/CWE-77). An attacker who can reach the appliance's web interface over the network can send a crafted 'ipaddr' value to execute arbitrary operating-system commands; the CVSS 4.0 score of 9.3 reflects no privileges or user interaction required and high impact on the device's confidentiality, integrity, and availability, as well as on connected systems. Successful exploitation effectively grants remote code execution on the appliance, which is typically used as a network video streaming endpoint. Only QVidium Opera11 is affected, and the vendor has gone out of business, so no fixed version or official support is available. The exploit has been publicly disclosed and may be utilized (EPSS estimates a 1.9% chance of exploitation within 30 days, percentile 78); the issue is not yet listed in CISA KEV and no PoC is catalogued in this feed.

What to do: No patch is forthcoming because QVidium is no longer in business, so mitigation must be network-based: restrict access to the appliance's management/web interface (the /cgi-bin/net_tr.cgi endpoint) with firewall rules or ACLs and avoid exposing it to the internet. Check whether any Opera11 units are internet-reachable and whether net_tr.cgi responds to unauthenticated requests. Plan replacement or isolation of these end-of-life appliances, since they will receive no security updates.