CVE-2026-36829
Panabit PAP-XM320 routers running firmware version 7.7 or earlier have a flaw that lets attackers bypass the login screen. By sending a specially crafted cookie, an attacker can trick the device into thinking they are already logged in and gain full control. This flaw is serious because it gives attackers unrestricted access to the router.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Panabit PAP-XM320 routers, firmware versions up to and including 7.7.
Real-world impact
An attacker can bypass authentication and gain full control of the router, allowing them to read or modify configuration, intercept traffic, or use the device for malicious purposes.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and gives an attacker complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.