The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.

CVE-2026-63586 describes a critical OS command injection vulnerability in a web-based management interface running a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username field is taken directly from the Authorization header without any sanitization and is inserted into a shell command executed via the system() function. An unauthenticated attacker with network access can craft a malicious username containing shell metacharacters to escape the command context and execute arbitrary commands with root privileges. No authentication is required to exploit this vulnerability. The flaw is classified as a pre-authentication remote code execution (RCE) issue. It affects embedded or IoT-class devices using this management interface. Advisories have been published by NVD and CERT VDE.