CVE-2026-83772

CVE-2026-83772 is a command injection vulnerability (CWE-74/CWE-77) in the c_set_reports_decode function of the mail-report.sh script, part of the JSON-parsing component of the Cobham SATCOM VSAT7090 Maritime Satellite Router, affecting builds up to and including 20260704. A remote attacker with low-privileged access (the CVSS 4.0 vector shows network reachability with low attack complexity but privileged credentials required) can manipulate the sender/recipients argument, causing injected commands to be executed on the router. Successful exploitation yields high impact on confidentiality, integrity, and availability of the device and subsequent systems, effectively amounting to privileged command execution on the satellite terminal. Any operator running VSAT7090 firmware up to 20260704 is affected, and the vendor was contacted before disclosure but did not respond. The exploit is described as public and usable, though no standalone public PoC is catalogued, the flaw is not in CISA KEV, and EPSS currently estimates a 1.7% chance of exploitation within 30 days (76th percentile).

What to do: No fixed release is documented because the vendor did not respond to the disclosure, so inventory networks for VSAT7090 units running builds up to 20260704 and restrict access to the mail-report functionality and management interfaces to trusted hosts and accounts, since exploitation requires privileged credentials. Apply firewall/ACL rules limiting the router's reachability from satellite and onboard networks and review logs for anomalous commands tied to the sender/recipients fields. Monitor the vendor for an updated build beyond 20260704 and verify it when released.