CVE-2026-36356
The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.
- Affected products
- Forge Slt711, Goahead
- CVSS 3.1
- 9.1 CRITICAL
- EPSS
- 13.5% (96th percentile)
- Weakness
- CWE-78, CWE-306
- NVD status
- Awaiting Analysis
- Published
- 2026-05-05
CVE-2026-36356 at NVD
4 known exploits for CVE-2026-36356
Proof-of-concept code and exploit modules indexed by Sploitus