CVE-2026-26213 is a critical unauthenticated command injection flaw (CVSS 9.8) in thingino-firmware, in the WiFi captive portal CGI script. It can give a remote attacker root on the device. No fixed version is listed, so check the project's releases. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- thingino-firmware up to the firmware-2026-03-16 release, per the record
- VulnCheck lists affected firmware as up to commit e3f6a41, published 15 March 2026
- No fixed version is listed in the advisory
The project's firmware-2026-03-15 release is linked in the record, but the advisory does not say whether it contains the fix. Check the project's releases and advisory for the current state.
How to check if you're exposed
Identify devices running thingino firmware, usually IP cameras you have flashed yourself, and note the build date or commit. Check the project's releases for something newer than the affected range. Then check whether each device exposes its web interface to untrusted networks, since the flaw is reachable without authentication.
If you cannot confirm the fix, treat the device as exposed.
What to do now
- Check the thingino project's releases and advisory for a fixed build and flash it when confirmed.
- Keep the devices off the internet and off untrusted networks.
- Put cameras on their own network segment with firewall rules that limit what they can reach.
- If a device may have been exposed, reflash it and set new credentials and keys.
- Review SSH keys and password settings on devices that were reachable.
Why it matters
CWE-78 is OS command injection. The description says the captive portal CGI script uses an eval function in its query and post parsing, so names of HTTP parameters can be executed as shell code. The portal exists to help a device join WiFi, so it is reachable early and without a login.
The description says the end result is commands as root, including privileged configuration changes such as a root password reset and changes to SSH authorized keys, which would leave a device persistently compromised. We rely on the record for that statement.
Connected cameras are attractive targets because they are numerous, rarely monitored and often sit inside the network. A flaw like this is a good argument for segmenting them.
Quick check
Is there a fixed version?
The advisory we read lists none. Check the project's releases.
Why is the captive portal a risk?
It is reachable without authentication, and the flawed code runs as root according to the record.
Sources
Last reviewed: 19 October 2026.
