TVN ID	TVN-202601010
CVE ID	CVE-2026-1427, CVE-2026-1428, CVE-2026-1429
CVSS	CVE-2026-1427： 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2026-1428： 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2026-1429： 5.4 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products	Single Sign-On Portal System version before IFTOP_P4_181
Description	CVE-2026-1427： Single Sign-On Portal System has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server. CVE-2026-1428： Single Sign-On Portal System has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server. CVE-2026-1429： Single Sign-On Portal System has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Solution	Update to version IFTOP_P4_181 or later
Credit	YuCheng Lin(CHT Security)
Public Date	2026-01-26