CVE-2026-22097
Received Received - Intake

Firmware Update Missing Signature Validation Leading to Arbitrary Code Execution

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Dutch Institute for Vulnerability Disclosure

Description
The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-22097
EUVD
EUVD-2026-43331

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists because the firmware update mechanism does not perform cryptographic signature validation. As a result, anyone who has access to the firmware update capability can upload arbitrary files.

Uploading arbitrary files can lead to arbitrary code execution, meaning an attacker could run malicious code on the affected device.

Impact Analysis

The vulnerability can have severe impacts because it allows an attacker to execute arbitrary code on the affected system without any privileges or user interaction.

This could lead to full compromise of the device, unauthorized control, data theft, disruption of services, or further attacks within a network.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart