CVE-2026-63586: Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any device whose web-based management interface is reachable by an attacker over the network is exposed. Exploitation does not require prior authentication or user interaction.
What does an attacker need to exploit this issue?
The attacker needs network access to the device's web management interface and must send an HTTP Basic Authentication request with a specially crafted username containing shell metacharacters. No valid credentials are required.
What level of access could exploitation provide?
Successful exploitation allows arbitrary command execution with root privileges on the affected device. This can compromise confidentiality, integrity, and availability.
How can I determine whether an attack attempt may have occurred?
Review HTTP request or web-management logs for malformed or unusual HTTP Basic Authentication usernames, especially values containing shell metacharacters. The provided information does not identify specific command artifacts or log locations.