CVE-2026-83772: Cobham SATCOM VSAT7090 RCE Vulnerability

CVE-2026-83772 Overview

CVE-2026-83772 is a command injection vulnerability in the Cobham SATCOM VSAT7090 Maritime Satellite Router affecting firmware versions up to 20260704. The flaw resides in the c_set_reports_decode function within the mail-report.sh script, part of the device's JSON parsing component. Attackers can manipulate the sender and recipients arguments to inject arbitrary operating system commands. The vulnerability is exploitable remotely and a public exploit exists. The vendor was contacted early in the disclosure process but did not respond.

Critical Impact
Remote authenticated attackers can execute arbitrary commands on maritime satellite routers, gaining full control over shipboard communications infrastructure.

Affected Products

Cobham SATCOM VSAT7090 Maritime Satellite Router (firmware up to 20260704)
mail-report.sh component handling JSON report configuration
c_set_reports_decode function processing sender/recipients arguments

Discovery Timeline

2026-09-01 - CVE-2026-83772 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83772

Vulnerability Analysis

The vulnerability is a command injection flaw [CWE-74] in the c_set_reports_decode function of mail-report.sh. This shell script processes JSON-formatted mail report configurations and uses attacker-controllable fields, sender and recipients, directly in shell contexts without sanitization. When a request is submitted to configure email reporting, the parser passes user-supplied values into commands that are executed by the underlying shell, enabling arbitrary OS command execution on the router.

The VSAT7090 provides Very Small Aperture Terminal (VSAT) satellite connectivity for maritime vessels. Successful exploitation compromises confidentiality, integrity, and availability of shipboard networks, with cascading impact on connected systems. The attack requires low-level privileges and no user interaction.

Root Cause

The root cause is improper neutralization of special elements in shell command construction. The c_set_reports_decode function concatenates the sender and recipients JSON fields into shell command strings without validating or escaping metacharacters such as backticks, $(...), semicolons, or pipes. Any user with access to the report configuration endpoint can break out of the intended command context.

Attack Vector

Exploitation occurs over the network against the router's management interface. An attacker submits a crafted JSON payload to the report configuration endpoint containing shell metacharacters in the sender or recipients fields. The mail-report.sh script then interprets the injected payload as commands executed with the privileges of the reporting service, typically root on embedded Linux devices. A public exploit is available, lowering the barrier to weaponization.

No verified proof-of-concept code has been published in a form suitable for reproduction here. See the VulDB entry for CVE-2026-83772 for additional technical detail.

Detection Methods for CVE-2026-83772

Indicators of Compromise

Unexpected outbound connections initiated from the VSAT7090 management plane after report configuration changes
Presence of shell metacharacters (;, |, `, $() in sender or recipients fields captured in HTTP request logs
Modifications to mail-report.sh execution artifacts or unexpected child processes spawned by the mail reporting service
New or unknown cron entries, SSH authorized keys, or listener processes on the router

Detection Strategies

Inspect HTTP request bodies to the report configuration endpoint for non-standard characters in sender and recipients JSON fields
Monitor process trees on the router for shell processes spawned as descendants of the mail reporting workflow
Correlate configuration change events with subsequent outbound network activity from the device management VLAN

Monitoring Recommendations

Forward router syslog, authentication events, and configuration change logs to a centralized SIEM for behavioral analysis
Baseline expected outbound destinations from satellite terminals and alert on deviations
Track administrative access to the VSAT7090 web interface and flag repeated report configuration modifications

How to Mitigate CVE-2026-83772

Immediate Actions Required

Restrict network access to the VSAT7090 management interface to trusted administrative networks only via ACLs or firewall rules
Rotate all administrative credentials on affected devices and enforce strong, unique passwords
Audit existing report configurations for suspicious sender or recipients values that may indicate prior exploitation
Isolate affected routers from unrelated shipboard networks until a vendor fix is available

Patch Information

No vendor patch is currently available. According to the disclosure, Cobham SATCOM did not respond to the researcher's contact attempts. Operators should monitor the VulDB advisory and Cobham SATCOM support channels for future firmware releases addressing CVE-2026-83772.

Workarounds

Place the VSAT7090 management interface behind a VPN or jump host to prevent direct network exposure
Disable the mail reporting feature if it is not operationally required
Apply strict role-based access control so only vetted administrators can modify report configurations
Deploy network intrusion detection signatures that flag shell metacharacters within JSON payloads sent to the router

bash

# Example firewall rule to restrict router management access
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP