External risk intelligence

Remote Code Execution in iStoreOS Task ID Handling

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78797

iStoreOS is a specialized operating system designed for routers and network appliances. As a router management interface, it is frequently deployed at the network edge, making the administrative web interface and associated services a common target for internet-reachable access.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated remote code execution vulnerability exists in iStoreOS, allowing attackers to run their own code on affected systems without prior authorization. This type of vulnerability, if exploited, could potentially lead to a compromise of the device's integrity and functionality. The main concern is confirming relevance and exposure.

Remote attackers can execute arbitrary code.
This affects network devices, potentially impacting operations.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger a code execution vulnerability in iStoreOS by sending a specially crafted request that targets the `task_id` parameter within the `tasks-lib.lua` file. This allows an unauthenticated attacker to execute arbitrary code on the affected system.

Requires network access to the device.
Triggers by manipulating a task ID parameter.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in iStoreOS allows a remote attacker to execute arbitrary code when supported by the advisory. This could impact the integrity and availability of the affected system.

System code integrity.
Remote code execution via task ID.
Compromise of system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for network infrastructure and appliance management should prioritize addressing this vulnerability. The first practical step involves identifying all instances of the affected technology, confirming their exposure to the network and business criticality, and then locating the specific system owner or team accountable for remediation. Subsequently, a plan for addressing the risk can be developed.

Network and appliance owners should act.
Verify external reachability and business impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is iStoreOS?

iStoreOS is a specialized operating system built for routers and network appliances. It serves as an open-source, user-friendly distribution based on OpenWrt, designed to simplify network management and extend the functionality of hardware devices. Users typically deploy it to manage traffic, security, and peripheral services directly from their network equipment.

What does CVE-2026-78797 mean?

This CVE describes a flaw classified as CWE-94, or Improper Control of Generation of Code. In simpler terms, the software incorrectly handles data provided to it, allowing that data to be executed as commands. Because of this vulnerability in the task handling logic, an attacker can trick the system into running unauthorized instructions.

How is this vulnerability triggered?

An attacker triggers the bug by sending a specially crafted request to the system that targets the `task_id` parameter in `tasks-lib.lua`. This requires no prior authentication or user interaction. Note that standard, legitimate interactions with the router's dashboard that do not involve manipulating this specific task identification parameter will not trigger the flaw.

Is my device at risk if it is behind a firewall?

Halo Surface Signal notes that because iStoreOS is often used on routers at the network edge, the administrative interface is frequently reachable from the internet. Devices exposed directly to the public web are at the highest risk. If your instance is strictly internal and unreachable from the outside, the path for an external, unauthenticated attacker is significantly restricted.

What should I do if I use iStoreOS?

Begin by creating an inventory of all your iStoreOS appliances to understand where they exist in your network. Assess each device to determine if its management interface is accessible externally or if it is isolated. Identify the personnel responsible for these systems so you can coordinate a plan to mitigate the risk and monitor for official updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.