CVE-2026-38711

Multiple versions of TR and WR series products contain a critical command injection vulnerability in the system.upgrade_check interface, allowing attackers to execute arbitrary commands with root privileges through specially crafted input. Organizations using these affected products should prioritize immediate remediation to mitigate the risk of unauthorized access and potential system compromise. Security teams must assess their environments for these specific versions and apply necessary patches or mitigations without delay.