Skip to Content

Security Advisory CGP-7915-SA - Unauthenticated Remote Code Execution in Embedded PHP Runtime ("php2shell", CVE-2026-109618 / CVE-2026-109619) on Gigaset Nx70 IP PRO Devices

Table of Content

Advisory ID:CGP-7915-SA
Publication Date:23.10.2026
Last Updated:23.10.2026
Advisory Status:INTERIM – fixed release in preparation
Current Version:V0.9
Related CVE(s):CVE-2026-109618, CVE-2026-109619
CVSS v4.0 Base Score:9.2 (Critical) – see Severity & Scoring

Summary

On 21.10.2026 the PHP project disclosed two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619, publicly known as "php2shell"). Both can allow an unauthenticated attacker to execute arbitrary code with the privileges of the web server process by sending crafted HTTP requests.

The web-based management interface (WebUI) of the affected Gigaset devices is built on PHP and is therefore affected. Gigaset has integrated the PHP version containing the upstream fixes into its firmware. A fixed firmware release is currently being prepared and will be published on this page as soon as it is available.

Success

The risk depends strongly on network exposure. In the typical deployment, the device is operated in an internal network that does not permit web access to the device from outside (e.g. from the Internet or other untrusted networks). In this case, the risk is very low.

Affected Products

  • Product Name(s): Gigaset N530 IP PRO, N610 IP PRO, N670 IP PRO, N770 IP PRO, N870 IP PRO, N870E IP PRO, IP Base Comfort II, BasicLine IP
  • Affected Version(s) / Build(s): v2.71.0 and lower
  • Affected Component: Embedded PHP runtime used by the WebUI (HTTP/HTTPS)

Mitigations / Workarounds

  • Update the device to v2.71.1 or later as soon as it is published on this page (see Solution / Patch Information).
  • Until the update has been carried out, please follow the Recommendations below.

Recommendation

The vulnerabilities can only be exploited by an attacker who can reach the device's WebUI via HTTP/HTTPS. Until the update is installed:

  • Make sure the WebUI is not reachable from the Internet or other untrusted networks (no port forwarding / NAT rule, public IP address or reverse proxy). This corresponds to the typical installation.
  • If remote administration is required, use a VPN to the management network instead of exposing the WebUI directly.

Solution / Patch Information

Available Fixes

  • Patched Version(s): v2.71.1 – release in preparation, will be published here immediately upon availability
  • Download / Update Instructions: FAQ - Firmware update - XWiki

Technical Changes

The embedded PHP runtime was updated to a version that contains the upstream fixes for CVE-2026-109618 and CVE-2026-109619 (PHP 8.2.35).

Vulnerability Details

Description

CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (use-after-free across requests) are memory-safety flaws in the PHP core (CWE-416). Crafted HTTP requests can trigger them and lead to code execution. Technical details: see References.

Impact Assessment

Arbitrary code execution on the device with the privileges of the web server process (e.g. configuration manipulation, disclosure of SIP credentials, service disruption). High impact on confidentiality, integrity and availability. Gigaset is not aware of any exploitation against Gigaset devices.

Severity & Scoring

  • CVSS v4.0 Score: 9.2 (Critical) – as rated by the PHP project
  • Vector: CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    • AV:N (Network) – Vulnerable via the network (WebUI).
    • AC:H (High) – Successful exploitation requires bypassing memory-related conditions beyond the attacker's control.
    • AT: P (Present) – Exploitation depends on specific runtime conditions (memory state, worker reuse).
    • PR:N (None) – No login is required.
    • UI:N (None) – No other user needs to be involved.
    • VC:H/VI:H/VA:H – Complete loss of confidentiality, integrity and availability of the device.
    • SC:N/SI:N/SA:N – No direct impact on subsequent systems.

For comparison with earlier advisories using CVSS v3.x: CVSS v3.1 Base Score 8.1 (High), CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Gigaset assessment).

Success

Environmental note: In deployments where the WebUI is not reachable from untrusted networks, the effective risk is considerably lower (attack vector effectively limited to the adjacent/internal network).

Acknowledgements

The vulnerabilities were reported to and disclosed by the PHP project. Gigaset thanks the PHP security team and the researchers involved.

Timeline

EventDate
Vulnerabilities disclosed by PHP project21.10.2026
Impact on Gigaset products analysed22.10.2026
Fixed PHP version integrated22.10.2026
Fix tested22.10.2026 - ongoing
Advisory published (interim)23.10.2026
Fixed firmware releasedWill be released early next week

Contact Information

For questions, further details, or follow‑up reports:

References