Security Advisory CGP-7915-SA - Unauthenticated Remote Code Execution in Embedded PHP Runtime ("php2shell", CVE-2026-109618 / CVE-2026-109619) on Gigaset Nx70 IP PRO Devices
Summary
On 21.10.2026 the PHP project disclosed two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619, publicly known as "php2shell"). Both can allow an unauthenticated attacker to execute arbitrary code with the privileges of the web server process by sending crafted HTTP requests.The web-based management interface (WebUI) of the affected Gigaset devices is built on PHP and is therefore affected. Gigaset has integrated the PHP version containing the upstream fixes into its firmware. A fixed firmware release is currently being prepared and will be published on this page as soon as it is available.
Success
The risk depends strongly on network exposure. In the typical deployment, the device is operated in an internal network that does not permit web access to the device from outside (e.g. from the Internet or other untrusted networks). In this case, the risk is very low.
Affected Products
- Product Name(s): Gigaset N530 IP PRO, N610 IP PRO, N670 IP PRO, N770 IP PRO, N870 IP PRO, N870E IP PRO, IP Base Comfort II, BasicLine IP
- Affected Version(s) / Build(s): v2.71.0 and lower
- Affected Component: Embedded PHP runtime used by the WebUI (HTTP/HTTPS)
Mitigations / Workarounds
- Update the device to v2.71.1 or later as soon as it is published on this page (see Solution / Patch Information).
- Until the update has been carried out, please follow the Recommendations below.
Recommendation
The vulnerabilities can only be exploited by an attacker who can reach the device's WebUI via HTTP/HTTPS. Until the update is installed:- Make sure the WebUI is not reachable from the Internet or other untrusted networks (no port forwarding / NAT rule, public IP address or reverse proxy). This corresponds to the typical installation.
- If remote administration is required, use a VPN to the management network instead of exposing the WebUI directly.
Solution / Patch Information
Available Fixes
- Patched Version(s): v2.71.1 – release in preparation, will be published here immediately upon availability
- Download / Update Instructions: FAQ - Firmware update - XWiki
Security Advisory CGP-7915-SA - Unauthenticated Remote Code Execution in Embedded PHP Runtime ("php2shell", CVE-2026-109618 / CVE-2026-109619) on Gigaset Nx70 IP PRO Devices - XWiki
Security Advisory CGP-7915-SA - Unauthenticated Remote Code Execution in Embedded PHP Runtime ("php2shell", CVE-2026-109618 / CVE-2026-109619) on Gigaset Nx70 IP PRO Devices
pro-wiki.gigaset.com
