OS Command Injection via SSH Console (Root Privilege Escalation)
CVE-2026-77120 Published on September 9, 2026

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.

NVD

Vulnerability Analysis

CVE-2026-77120 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2026-77120 has been classified to as a Shell injection vulnerability or weakness.


Affected Versions

Schneider Electric PowerLogic T300 Version Versions 2.9.8-5620 and prior is affected by CVE-2026-77120