CVE-2026-23759: Perle IOLAN Terminal Server RCE Vulnerability

CVE-2026-23759 Overview

CVE-2026-23759 is an authenticated OS command injection vulnerability affecting Perle IOLAN STS/SCS terminal server models running firmware versions prior to 6.0. The vulnerability exists in the restricted shell accessible over Telnet or SSH, where the ps command fails to properly sanitize user-supplied arguments before passing them to an sh -c invocation running with root privileges. An authenticated attacker can exploit this flaw by injecting shell metacharacters after the ps subcommand to execute arbitrary OS commands with full root privileges, leading to complete compromise of the underlying operating system.

Critical Impact

Authenticated attackers can achieve full root-level command execution on affected Perle IOLAN terminal servers, enabling complete device compromise, lateral movement across connected networks, and persistent access to critical infrastructure.

Affected Products

• Perle IOLAN STS terminal server models with firmware versions prior to 6.0
• Perle IOLAN SCS terminal server models with firmware versions prior to 6.0
• All IOLAN STS/SCS devices accessible via Telnet or SSH with authenticated user access

Discovery Timeline

• 2026-03-17 - CVE-2026-23759 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23759

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the restricted shell environment provided to authenticated users on Perle IOLAN STS/SCS terminal servers.

When an authenticated user accesses the device via Telnet or SSH, they are presented with a restricted shell that offers limited commands for device management. Among these commands is the ps utility, which is intended to display process information. However, the implementation of this command does not properly validate or sanitize arguments supplied by the user before incorporating them into an operating system command execution context.

The vulnerable code path constructs a shell command using user-supplied input and executes it via sh -c with root privileges. This design flaw allows an attacker to break out of the intended command context by injecting shell metacharacters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()).

Root Cause

The root cause of CVE-2026-23759 is the lack of proper input sanitization in the restricted shell's ps command handler. The implementation directly concatenates user-supplied arguments into a shell command string without filtering or escaping shell metacharacters. When this unsanitized string is passed to sh -c, the shell interprets the injected metacharacters as command separators or operators, allowing arbitrary command execution.

This represents a fundamental secure coding failure where user input is trusted without validation in a security-sensitive context. The restricted shell was designed to limit user capabilities, but this implementation oversight completely undermines that security boundary.

Attack Vector

The attack requires network access to the Telnet or SSH service on the affected device and valid user credentials. Once authenticated, an attacker can exploit the vulnerability through the following general approach:

1. Establish a Telnet or SSH connection to the target IOLAN device
2. Authenticate with valid user credentials (even low-privilege accounts)
3. Access the restricted shell environment
4. Execute the ps command with shell metacharacters injected as arguments
5. The injected commands execute with root privileges on the underlying system

The attacker can leverage this access to read sensitive configuration data, modify device settings, establish persistent backdoors, pivot to other network-connected systems, or cause denial of service conditions. For more technical details on this vulnerability, see the VulnCheck Advisory on Perle IOLAN.

Detection Methods for CVE-2026-23759

Indicators of Compromise

• Unusual or unexpected processes running on Perle IOLAN devices that are not part of standard firmware operations
• SSH or Telnet session logs showing ps commands with shell metacharacters such as ;, |, $(), or backticks
• Evidence of outbound network connections from the terminal server to unexpected destinations
• Modified configuration files or new user accounts on affected devices

Detection Strategies

• Monitor Telnet and SSH authentication logs for successful logins followed by command execution anomalies
• Implement network intrusion detection rules to identify shell metacharacters in terminal server session traffic
• Review device logs for commands containing injection patterns like ps;, ps|, or ps$( sequences
• Deploy network segmentation monitoring to detect unexpected traffic originating from terminal servers

Monitoring Recommendations

• Enable verbose logging on all Perle IOLAN devices and forward logs to a centralized SIEM
• Configure alerts for any shell commands containing special characters on terminal server devices
• Establish baselines for normal terminal server behavior and alert on deviations
• Implement session recording for all administrative access to critical infrastructure devices

How to Mitigate CVE-2026-23759

Immediate Actions Required

• Upgrade Perle IOLAN STS/SCS firmware to version 6.0 or later immediately
• Restrict network access to Telnet and SSH services using firewall rules and access control lists
• Audit all user accounts on affected devices and disable unnecessary accounts
• Review authentication logs for signs of prior exploitation attempts

Patch Information

Perle Systems has addressed this vulnerability in firmware version 6.0 and later. Organizations should download the latest firmware from the Perle Server SDS Rackmount Info page. Review the Perle IOLAN User Guide PDF for upgrade procedures and configuration guidance.

Workarounds

• Disable Telnet access entirely and restrict SSH access to trusted management networks only
• Implement network segmentation to isolate terminal servers from untrusted network segments
• Use jump hosts or bastion servers for administrative access to minimize direct exposure
• Deploy multi-factor authentication where supported and enforce strong password policies

# Example: Restrict SSH access to management network only (firewall rule)
# Add to network firewall or device ACL configuration
iptables -A INPUT -p tcp --dport 22 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
# Block Telnet access entirely until firmware is upgraded
iptables -A INPUT -p tcp --dport 23 -j DROP