Search

VU#360868: Local Privilege escalation vulnerability in Analog Way Picturall Quad Compact Mark II version 3.5.8

Overview Version 3. 5. 8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments. The core firmware includes a maintenance script called create_local_installer. sh , and the default script permission allows the low-privileged user, picmedia , to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version. txt , with a directory traversal string and a payload file. create_local_installer. sh reads input from picturall-version.