CVE-2026-88738

Received Received - Intake

Unrestricted File Upload in Jazzware RT1000 Edge webUI

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: MITRE

Description

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An authenticated attacker can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be accessed directly over HTTP without authentication, resulting in remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-88738

EUVD

EUVD-2026-84184

Affected Vendors & Products

Vendor	Product	Version / Range
jazzware	rt1000_edge_webui	20.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload flaw in Jazzware RT1000 Edge webUI version 20.0.1. It allows an authenticated attacker to upload a server-side executable file through the upgrade package upload feature. The uploaded file is stored in a web-accessible location and can be executed remotely without authentication, leading to full system compromise.

Detection Guidance

Check for unexpected executable files in web-accessible directories, particularly in the Jazzware RT1000 Edge webUI v. 20.0.1 upgrade package upload location. Inspect HTTP traffic for unauthorized file uploads or direct access to executable files.

Impact Analysis

An attacker could exploit this to upload malicious files, gain unauthorized access to the system, execute arbitrary code, and take full control of the affected device. This could lead to data theft, system damage, or further network compromise if the device is connected to other systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security). Unrestricted file uploads enabling remote code execution pose significant risks to data confidentiality and integrity.

Mitigation Strategies

Disable the upgrade package upload functionality in Jazzware RT1000 Edge webUI v. 20.0.1. Restrict write permissions to web-accessible directories. Monitor network traffic for unauthorized file uploads or access attempts.

Hi! I’m here to help you understand CVE-2026-88738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70