CVE-2026-1358: Airleader Master RCE Vulnerability

CVE-2026-1358 Overview

CVE-2026-1358 is a critical unrestricted file upload vulnerability affecting Airleader Master versions 6.381 and prior. The vulnerability exists in multiple webpages that run with maximum privileges and allow file uploads without proper validation or restriction. This security flaw enables an unauthenticated attacker to upload malicious files to the server, potentially achieving remote code execution (RCE) with elevated privileges.

Critical Impact

Unauthenticated attackers can exploit unrestricted file upload functionality to achieve remote code execution on vulnerable Airleader Master servers running with maximum privileges.

Affected Products

• Airleader Master version 6.381
• Airleader Master versions prior to 6.381
• All Airleader Master deployments running vulnerable firmware

Discovery Timeline

• February 12, 2026 - CVE-2026-1358 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1358

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which represents a severe security weakness in web applications. The Airleader Master device contains multiple web pages that accept file uploads without implementing proper security controls. Since these web interfaces operate with maximum (root or administrative) privileges, any code executed through uploaded files inherits these elevated permissions.

The lack of authentication requirements makes this vulnerability particularly dangerous, as attackers do not need valid credentials to exploit it. Combined with the absence of file type restrictions, content validation, or upload directory restrictions, this creates a direct path to system compromise.

Root Cause

The root cause of CVE-2026-1358 stems from a failure to implement fundamental secure file upload controls in the Airleader Master web application. The vulnerable endpoints lack:

• Authentication mechanisms to verify user identity before accepting uploads
• File type validation to restrict uploads to safe file formats
• Content inspection to verify file contents match their declared type
• Proper access controls on upload directories to prevent execution of uploaded files
• Privilege separation to limit the impact of compromised upload functionality

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. An attacker can remotely target the vulnerable file upload endpoints exposed on the Airleader Master web interface. The typical exploitation flow involves:

1. Identifying an Airleader Master device accessible over the network
2. Locating the vulnerable file upload endpoints on the web interface
3. Crafting a malicious file (such as a web shell or reverse shell script) designed for the target platform
4. Uploading the malicious file without authentication
5. Accessing or triggering the uploaded file to execute arbitrary code with maximum privileges
6. Achieving full system compromise with administrative access

Since the web application runs with maximum privileges, successful exploitation grants the attacker complete control over the affected system, enabling data exfiltration, lateral movement, or disruption of industrial control operations.

Detection Methods for CVE-2026-1358

Indicators of Compromise

• Unexpected files appearing in web-accessible upload directories on Airleader Master devices
• Web server logs showing unauthenticated POST requests to file upload endpoints
• Newly created files with executable extensions (.php, .jsp, .sh, .py) in web directories
• Outbound network connections from the Airleader Master device to unknown external IP addresses
• Process execution anomalies showing web server processes spawning unexpected child processes

Detection Strategies

• Monitor HTTP/HTTPS traffic to Airleader Master devices for suspicious file upload requests
• Implement network segmentation and monitor for unauthorized access attempts to ICS/SCADA network segments
• Deploy file integrity monitoring on Airleader Master systems to detect unauthorized file creation
• Analyze web server access logs for patterns indicating exploitation attempts

Monitoring Recommendations

• Enable comprehensive logging on Airleader Master devices and forward logs to a centralized SIEM
• Set up alerts for file creation events in web application directories
• Monitor network traffic for connections to known malicious infrastructure
• Conduct regular vulnerability assessments of industrial control system assets

How to Mitigate CVE-2026-1358

Immediate Actions Required

• Restrict network access to Airleader Master devices to authorized personnel only
• Implement network segmentation to isolate vulnerable ICS devices from untrusted networks
• Deploy a web application firewall (WAF) to filter malicious file upload attempts
• Audit Airleader Master systems for signs of prior compromise

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-043-10 for official remediation guidance and any available patches or firmware updates from the vendor. Additional technical details are available in the CSAF advisory on GitHub.

Workarounds

• Disable or restrict access to file upload functionality on vulnerable Airleader Master devices
• Implement strict firewall rules allowing only necessary traffic to and from the device
• Use VPN or other secure remote access methods instead of direct internet exposure
• Deploy application-layer filtering to block potentially dangerous file types at the network perimeter

# Example: Network segmentation using firewall rules
# Restrict access to Airleader Master web interface to management VLAN only
iptables -A INPUT -p tcp --dport 80 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP