CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
Unauthenticated attackers can execute arbitrary OS commands on Samsung QA-Board devices via the output redo/tuning interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110392?
CVE-2026-110392 is a critical command injection vulnerability in Samsung Open Source QA-Board, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
Weakness: CWE-78
Which versions are affected by CVE-2026-110392?
How do I fix CVE-2026-110392?
No fix has been published for CVE-2026-110392 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-110392 being exploited?
There is no known exploitation of CVE-2026-110392 in the wild and no public exploit code.
Sources
Also known as GHSA-2m98-3p37-f6h9.