OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low("monitoring user") or higher privilege to execute an arbitrary OS command.

OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low("monitoring user") or higher privilege to execute an arbitrary OS command.

Network Cameras TRIFORA 3 series provided by TOA Corporation contain multiple vulnerabilities listed below.<ul><li>OS command injection (CWE-78) - CVE-2026-20759</li><li>Cross-site scripting (CWE-79) - CVE-2026-20894</li><li>Path traversal (CWE-22) - CVE-2026-22876</li></ul>Shogo Iyota of GMO Cybersecurity by Ierae reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.