TVN ID	TVN-202606004
CVE ID	CVE-2026-11844, CVE-2026-11845, CVE-2026-11846, CVE-2026-11847
CVSS	【CVE-2026-11844】 4.9 (Medium) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N 【CVE-2026-11845】 7.2 (High) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-11846】 8.1 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 【CVE-2026-11847】 4.3 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products	iVEC TANK-XM811 version before v1.0.4
Description	【CVE-2026-11844(Arbitrary File Read)】 Privileged remote attackers can access files outside the intended directory scope. 【CVE-2026-11845(OS Command Injection)】 Privileged remote attackers can inject arbitrary OS commands and execute them on the device. 【CVE-2026-11846(Arbitrary File Deletion)】 Authenticated remote attackers can exploit this vulnerability to delete arbitrary system files or directories, resulting in data destruction or service disruption. 【CVE-2026-11847(Path Traversal)】 Authenticated remote attackers can exploit this vulnerability to create directories in unintended system paths.
Solution	Update iVEC TANK-XM811 to version v1.0.4 or later.
Public Date	2026-06-12