CVE-2026-38710

Received Received - Intake

Command Injection in TR1200 and TR3000

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: MITRE

Description

TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-38710

EUVD

EUVD-2026-51646

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

TR1200 v2.4.15 and TR3000 v2.4.21 devices have a command injection vulnerability in the system.setclock interface. Attackers can exploit this by sending specially crafted input to execute arbitrary commands with root privileges.

Detection Guidance

To detect this vulnerability, check if your system is running TR1200 v2.4.15 or TR3000 v2.4.21. Verify the system.setclock interface for potential command injection by inspecting network traffic or logs for unusual commands.

Impact Analysis

This vulnerability allows attackers to gain full control over the affected devices as root. This could lead to unauthorized access, data theft, system manipulation, or disruption of device functionality.

Compliance Impact

The vulnerability allows arbitrary command execution as root, which could lead to unauthorized access, data breaches, or system compromise. This may violate compliance requirements under GDPR (data protection), HIPAA (health data security), or other regulations by enabling unauthorized data access or modification.

Mitigation Strategies

Immediately update TR1200 to a version later than v2.4.15 and TR3000 to a version later than v2.4.21. Disable or restrict access to the system.setclock interface if updates are not immediately available.

Hi! I’m here to help you understand CVE-2026-38710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70