{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-11846",
        "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "state": "PUBLISHED",
        "assignerShortName": "twcert",
        "dateReserved": "2026-06-10T07:50:58.661Z",
        "datePublished": "2026-06-12T09:31:52.698Z",
        "dateUpdated": "2026-06-12T10:54:07.905Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
                "shortName": "twcert",
                "dateUpdated": "2026-06-12T09:49:36.981Z"
            },
            "title": "IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion",
            "datePublic": "2026-06-12T09:28:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-22",
                            "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-126",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-126 Path Traversal"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "IEI Integration Corp",
                    "product": "iVEC TANK-XM811",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.0.4",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "The \niVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories,  resulting in data destruction or service disruption.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "The&nbsp;\niVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories,&nbsp; resulting in data destruction or service disruption.<br>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.twcert.org.tw/tw/cp-132-10969-4c4e2-1.html",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://www.twcert.org.tw/en/cp-139-10970-e4b21-2.html",
                    "tags": [
                        "third-party-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "LOW",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "HIGH",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "HIGH",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "HIGH",
                        "baseScore": 7.2,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
                    }
                },
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "LOW",
                        "userInteraction": "NONE",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "NONE",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "HIGH",
                        "baseScore": 8.1,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                    }
                }
            ],
            "source": {
                "advisory": "TVN-202606004",
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.2"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-06-12T10:53:43.811921Z",
                                "id": "CVE-2026-11846",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-06-12T10:54:07.905Z"
                }
            }
        ]
    }
}