{"id":"CVE-2025-26320","details":"t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.","modified":"2026-07-15T01:49:10.877257709Z","published":"2025-03-04T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26320.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/BaranTeyin1/vulnerability-research/tree/main/CVE-2025-26320"},{"type":"WEB","url":"https://github.com/t0mer/broadlinkmanager-docker/blob/master/broadlinkmanager/broadlinkmanager.py#L639-L657"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26320.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26320"},{"type":"PACKAGE","url":"https://github.com/t0mer/broadlinkmanager-docker"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/t0mer/broadlinkmanager-docker","events":[{"introduced":"0"},{"last_affected":"79e2ec93779381d3d82804e5f5d9ba2754c4c552"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:t0mer:broadlinkmanager:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.9.1"}]}}],"versions":["5.9.1","5.8.4","5.8.3","5.8.2","5.6.5","5.5.0","5.4.0","5.3.0","5.2.0","5.1.0","5.0.0","4.2.0","4.1.0","4.0.0","2.6.2","2.6.1","2.6.0","2.7.6","2.7.5","3.0.0","2.4.0","2.3.0","2.2.0","2.1.0","2.0.0","1.2.2","1.2.1","1.2.0","1.1.0","1.0.0","1.0","0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26320.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}