CVE-2026-5416: Command Injection via name parameter

Synopsis

Command injection in the name parameter of TURCK Managed Ethernet Switch firmware (TBEN-LL-SE-M2, TBEN-L4-SE-M2, and TBEN-L5-SE-M2 at versions 2.0.6.0 and below) allows a remote attacker with a low-privilege account to inject arbitrary operating system commands over the network without victim interaction. Successful exploitation gives the attacker full control of the affected device, including reading, modifying, and disrupting all switch functions. No fix version has been published; HarborGuard is tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the switch's management interface over the network; the vulnerability is exposed remotely via AV:N.

• AuthenticationRequired

  A valid low-privilege account on the device is sufficient; no administrator or elevated credentials are needed (PR:L).

• Victim interactionNot required

  No user action is needed; the attacker exploits the vulnerability entirely without involving another person (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required (AC:L, AT:N).

Blast Radius

• The attacker executes arbitrary operating system commands on the switch, achieving full system compromise.
• All stored configuration, credentials, and secrets held on the device are readable by the attacker (VC:H).
• The attacker can modify switch configuration, routing tables, and persisted settings (VI:H).
• The attacker can crash or fully disable the switch, disrupting all network traffic it carries (VA:H).