CVE-2026-83772Disclosure

CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail… https://www.cve.org/CVERecord?id=CVE-2026-83772

#schwachstellen CVE-2026-83772: Kritische Command-Injection in Cobham SATCOM VSAT7090 #cobhamsatcom #cve202683772 #vsat7090maritimesatelliterouter https://cybersecurity-news.de/cve-2026-83772-cobham-satcom-vsat7090-command-injection

CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail… https://www.cve.org/CVERecord?id=CVE-2026-83772

🚨 [MARITIME SATELLITE SECURITY] — A CRITICAL COMMAND-INJECTION FLAW HAS JUST BEEN DISCLOSED IN COBHAM SATCOM VSAT7090 MARITIME SATELLITE ROUTERS — AND A PUBLIC EXPLOIT ALREADY EXISTS CVE-2026-83772 can allow a low-privileged remote attacker to inject operating-system commands through attacker-controlled JSON fields processed by the router. CyberSignal Priority: 🔴 VERY HIGH 📅 Published: September 1, 2026 🆔 CVE-2026-83772 ⚠️ CVSS v3.1: 9.9 CRITICAL 🎯 Cobham SATCOM VSAT7090 🌊 Maritime Satellite Communications 🏷️ Command Injection · VSAT · Satellite · Maritime · Critical Infrastructure This is not a vulnerability in a normal desktop application. The affected device sits in: **satellite communications infrastructure used at sea.** And the public CVE record says exploit code is already available. ### 🔎 What happened CVE-2026-83772 affects the: **Cobham SATCOM VSAT7090 Maritime Satellite Router** through version: `20260704` The issue exists in: `http://mail-report.sh` specifically the: `c_set_reports_decode` function responsible for handling JSON-based configuration data. According to the CVE record, attacker-controlled values in fields such as: `sender` and `recipients` can reach command-processing logic without sufficient sanitization. Result: **OS command injection.** ### ⚔️ Attack chain Remote attacker with low-level access ↓ Crafted JSON request ↓ Malicious `sender` / `recipients` value submitted ↓ `http://mail-report.sh` processes input ↓ `c_set_reports_decode` fails to safely neutralize command content ↓ Operating-system command injection ↓ Potential compromise of router ↓ Confidentiality + integrity + availability impact ### ⚠️ Important detail This is NOT currently described as: **unauthenticated exploitation.** The published CVSS vector specifies: `PR:L` meaning: **low privileges are required.** That distinction matters. But once that access exists, the vulnerability is rated extremely severe because successful exploitation can potentially produce major impact beyond the vulnerable component itself. ### 🚢 What is affected The affected product belongs to the VSAT ecosystem: **Very Small Aperture Terminal satellite communications.** VSAT infrastructure can be used aboard maritime platforms to provide: internet connectivity operational communications remote monitoring business systems connectivity crew communications and other satellite-linked services. That makes compromise fundamentally different from exploiting an ordinary endpoint. A router may sit directly in the communications path. ### 🧠 Why this matters Network infrastructure occupies an unusually powerful position. Compromise an endpoint: you control one endpoint. Compromise communications infrastructure: you may influence or observe: traffic routing availability connected systems authentication flows. And maritime systems often operate: far from physical support teams ↓ with long equipment lifecycles ↓ through constrained satellite links ↓ inside operational environments where downtime is expensive. ### 💥 Public exploit status The CVE record explicitly states: **“The exploit is now public and may be used.”** The CVSS record also marks exploit maturity as: **Proof-of-Concept.** That does NOT prove active exploitation in real maritime environments. But it substantially changes defensive urgency. Disclosure ↓ technical details ↓ public PoC means defenders should assume exploitation research can accelerate quickly. ### ⚠️ Important caveat There is currently NO evidence in the sources reviewed showing: confirmed active exploitation in the wild. CISA KEV listing: ❌ Not currently listed. The disclosure also says the vendor was contacted before publication but: **did not respond.** At the time of this reporting, no vendor remediation is attached to the public CVE record. That does NOT necessarily mean a patch will not appear later. ### 🛡️ Defender action Organizations operating affected maritime satellite equipment should immediately: inventory VSAT7090 devices ↓ identify firmware/build versions ↓ restrict management exposure ↓ limit access to trusted management networks ↓ review privileged and low-privileged accounts ↓ inspect logs for unusual configuration requests ↓ monitor unexpected shell/process execution ↓ monitor configuration modifications ↓ contact the vendor/integrator for remediation guidance. Where possible: management interface → dedicated management network NOT: management interface → broadly reachable operational/user network. ### 🧠 CyberSignal insight **Satellite connectivity is part of the attack surface now. When the vulnerable device is the router carrying communications at sea, compromise can sit underneath every application depending on that connection.** Sources: CVE/MITRE · NVD · VulDB · OpenCVE