CVE-2026-20759

CVSS 8.7 HIGHEPSS 1.5%CWE-78

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

16 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low("monitoring user") or higher privilege to execute an arbitrary OS command.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

TOA Corporation · Multiple Network Cameras TRIFORA 3 series

References

https://jvn.jp/en/jp/JVN08087148/https://www.toa-products.com/securityinfo/pdf/tv2025-001jp.pdf