CVE-2026-4170 - Vulnerability Analysis

Overview

Topsec TopACM 3.0 contains a command injection caused by manipulation of the "template_path" argument in /view/systemConfig/management/nmc_sync.php HTTP Request Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to the latest version or apply vendor patches when available.

References

• https://my.feishu.cn/docx/EAFFdhzoeodDxfxeazNcxBzCnRf?from=from_copylink
• https://vuldb.com/?ctiid.351077
• https://vuldb.com/?id.351077
• https://vuldb.com/?submit.769768

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🔴 CVE-2026-4170 - Critical (9.8) A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_sync.php of the component HTTP Request Handler. Executing a manipulation of the argument ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4170/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner