CVE-2026-11845: IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection

Synopsis

An OS command injection vulnerability affects the iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp. The flaw is reachable over the network and requires a privileged (admin-level) account, but no interaction from any victim. A successful attacker can inject and execute arbitrary operating system commands on the device, gaining full read, write, and availability control over the affected system. A patched-image rebuild at version 1.0.4 is available on HarborGuard for environments running an affected version of iVEC TANK-XM811.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iVEC-IEI device's management interface over the network; there is no local-only or physical constraint on access.

• AuthenticationRequired

  A privileged (admin-level) account is required; the attacker must already hold or have stolen high-privilege credentials before the injection can be executed.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can trigger the vulnerability entirely without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or variable setup.

Blast Radius

• Reads any file or secret accessible to the device's OS process, including stored credentials, configuration data, and runtime secrets.
• Writes or overwrites arbitrary files on the device, enabling persistent backdoors or configuration tampering.
• Executes commands that crash or halt virtualization workloads running on the edge device, disrupting availability of hosted services.
• Full command execution scope means an attacker can pivot to lateral movement within the local network segment served by the edge appliance.