CVE-2026-36698

Xovis AG products, including APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B (version 2.10.1.1 and earlier), are vulnerable to an OS command injection vulnerability in the /sbin/ImportParamSet.sh script. The flaw occurs because the script processes symlinks from uploaded parameter archiv...