Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-14985 The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privile… https://www.cve.org/CVERecord?id=CVE-2026-14985
Post summary
CVE-2026-14985 flags a local privilege escalation flaw in the Analog Way Picturall firmware, but no PoC, exploit, active exploitation, or patch details are provided.
Picturall Quad Media Server Ships with Root Exploit via Unchecked Script > CVE-2026-14985 lets a low-privileged user gain full root control over Analog Way Picturall Quad Compact Mark II media servers > Analog Way fixed the issue in version 3.5.9 > CVE-2026-14985 gives any logged-in user full root access to an Analog Way Picturall Quad Compact Mark II media server with nothing more than a malicious USB drive > version 3.5.8 ships a script called createlocalinstaller dot sh that the low-privileged picmedia user can execute as root - no password required > Analog Way released version 3.5.9 to address the vulnerability > anyone still running 3.5.8 should treat those systems as fully compromised until patched - consider that any file or credential touched by picmedia might have been owned https://news.ojobit.com/story/picturall-quad-media-server-root-exploit-unchecked-script-5fd9a3
Post summary
The text describes a functional exploit script enabling root takeover on Analog Way Picturall Quad media servers, notes the availability of a patch, and warns of potential compromise.