CVE-2026-14985

Deferred Deferred - Pending Action

Local Privilege Escalation in Analog Way Picturall Quad Compact Mark II

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: CERT/CC

Description

The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-14985

EUVD

EUVD-2026-47714

Affected Vendors & Products

Vendor	Product	Version / Range
analog_way	picturall_quad_compact_mark_ii	to 3.5.8 (inc)
analog_way	picturall_quad_compact_mark_ii	From 3.5.9 (inc)
analog_way	picturall_quad_compact_mark_ii	3.5.8-security1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

Executive Summary

CVE-2026-14985 is a local privilege escalation vulnerability in Analog Way's Picturall Quad Compact Mark II media server firmware version 3.5.8. It occurs due to improper privilege delegation and insufficient input validation in a maintenance script called create_local_installer.sh. The script runs with root privileges but is executable by low-privileged users without a password.

Detection Guidance

Check if the firmware version is 3.5.8 by inspecting the device or running version-specific commands. Look for the presence of the vulnerable script create_local_installer.sh in the system. Verify if low-privileged users can execute this script without a password.

Impact Analysis

An attacker with local access can exploit this by crafting a malicious Ext4 disk image with a specially formatted picturall-version.txt file. The script fails to sanitize input, allowing directory traversal sequences that enable writing files outside the intended directory. This leads to arbitrary file writes in sensitive locations like /etc/cron.d, where attackers can modify system task schedules or configuration files to execute malicious code with full system privileges.

Compliance Impact

This vulnerability could lead to unauthorized access and full system compromise, which may violate compliance requirements for data protection standards like GDPR and HIPAA. Unauthorized privilege escalation could allow attackers to access, modify, or exfiltrate sensitive data, leading to potential data breaches and regulatory penalties.

Mitigation Strategies

Update the firmware to version 3.5.9 or apply the security-only hotfix 3.5.8-security1 if a full update is not possible. Remove or restrict execution permissions for the vulnerable script create_local_installer.sh until patched.

Hi! I’m here to help you understand CVE-2026-14985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70