TR7 ASP: Missing authentication for critical function allows OS command injection
Summary
TR7 ASP, a platform for load balancing and web application security offered as virtual and physical appliance, contains a missing authentication flaw in a critical function (CWE-306). According to the CNA record, an unauthenticated remote attacker with network access can trigger OS command injection on the appliance, with a CVSS base score of 9.8. Affected are versions 1.0.40.236 up to before 1.0.1554.2331 and 1.6.42.239 up to before 1.6.1554.2331.
Affected
- TR7 ASP 1.0.40.236 up to, not including, 1.0.1554.2331 (virtual and physical appliance)
- TR7 ASP 1.6.42.239 up to, not including, 1.6.1554.2331 (virtual and physical appliance)
Fixed in
- TR7 ASP 1.0.1554.2331 (branch 1.0)
- TR7 ASP 1.6.1554.2331 (branch 1.6)
The fixed builds are taken from the CVE ranges and VulDB; the vendor advisory could not be verified directly.
Workaround
- Unknown. No vendor workaround could be confirmed.
- Until patched, restrict management and admin access to internal networks or VPN.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No known exploitation in the wild; not listed in KEV.
- VulDB reports no public exploit, but remote attack is possible. This status is provisional.
Our recommendation
- Inventory all TR7 ASP virtual and physical appliances and record their exact versions.
- Upgrade to 1.0.1554.2331 (branch 1.0) or 1.6.1554.2331 (branch 1.6), or confirm the fix with TR7 or the distributor.
- Until patched, restrict access to management interfaces and confirm that no vulnerable interface is reachable from the internet.
- Check logs for unexpected administrative requests or OS-level activity on the appliances.
- Read TR-26-1327 for the authoritative version list and monitor NVD.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TR-CERT advisory TR-26-1327 siberguvenlik.gov.tr
- VulDB entry 419831 vuldb.com
- CVE-2026-16740 on threatint cve.threatint.com
- VulnRichment CVE-2026-16740 vulners.com
- Strix CVE-2026-16740 www.strix.ai
- Fortis Distribution: TR7 vendor page fortis-distribution.com
- OffSeq Radar CVE-2026-16740 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:01.
Original description (NVD)
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.