CISA issues update on CVE-2026-14985 affecting Analog Way server

Analog Way’s Picturall Quad Compact Mark II server, in version 3.5.8, contains a local privilege escalation vulnerability that results from improper privilege delegation and insufficient input validation in a maintenance script. Exploitation enables arbitrary file writes to privileged locations and the execution of arbitrary commands with root privileges, supporting complete system compromise.

The vulnerability is tracked as CVE-2026-14985. The product’s firmware includes a maintenance script named create_local_installer.sh. The default script permission allows the low-privileged user, picmedia, to execute the script as root without a password. An attacker can create a malicious Ext4 disk image that includes picturall-version.txt with a directory traversal string and a payload file. When processing attacker-supplied disk images, create_local_installer.sh reads input from picturall-version.txt. That input is not properly sanitized, allowing an attacker to provide directory traversal sequences. This lets the attacker manipulate the script to write files outside the intended extraction directory and execute a malicious payload. Because the script runs with root privileges, the behavior enables arbitrary file writes to sensitive system locations such as /etc/cron.d.

With local access, an attacker can write arbitrary files to privileged locations. The access enables modification of scheduled tasks and system configuration files. It can also allow the execution of arbitrary commands with full system privileges. The advisory states that an attacker does not need valid root credentials for straightforward and repeatable exploitation, resulting in complete system compromise. It also states this constitutes a Technical Impact = Total under the SSVC framework, meaning total control over the behavior of the software or total disclosure of all information on the affected system.

Analog Way released version 3.5.9 to address the vulnerability. Users are encouraged to update to the fixed release as soon as possible.

The advisory thanks reporter James Tully for responsibly disclosing the issue and notes that the document was written by Michael Bragg.

Source: kb.cert.org, by Michael Bragg.