OpenSSH command injection through an untrusted username (CVE-2026-35386)

Summary

Shell metacharacters in an untrusted username may cause command execution.

Vulnerability ID	Vulnerability Overview
CVE-2026-35386	Certain non-default ssh_config percent-token substitutions can pass an untrusted command-line username into a shell command without adequate protection. Embedded shell metacharacters may then execute unintended commands.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices