A high-severity vulnerability exists in certain NuCom wireless routers, allowing an unauthenticated attacker on the network to take complete control of the device. Successful exploitation could lead to a full network compromise, data theft, or the router being used for further malicious activities.

This vulnerability is an unauthenticated command injection flaw in the web management interface of the affected routers. An attacker can send a specially crafted HTTP request to the 'sys_log' page, injecting arbitrary operating system commands via the 'ping_addr' parameter. Because the input is not properly sanitized, these commands are executed on the device with root-level privileges, giving the attacker full control without requiring any prior authentication.

This vulnerability is rated as High severity with a CVSS score of 7.5. A successful exploit grants an attacker complete administrative control over the affected network device. This could lead to severe business consequences, including the interception of sensitive network traffic, theft of credentials and confidential data, disruption of network services, and using the compromised router as a pivot point to attack other internal systems. The device could also be co-opted into a botnet for use in larger-scale attacks like Distributed Denial-of-Service (DDoS), posing a reputational risk to the organization.

Immediate Action: Apply vendor security updates immediately. Organizations must prioritize the deployment of the firmware patches provided by NuCom to all affected devices to eliminate the vulnerability. After patching, review system and access logs for any signs of compromise that may have occurred before the update was applied.

Proactive Monitoring: Monitor web server logs on the routers for suspicious requests to the 'sys_log' page, specifically examining the 'ping_addr' parameter for shell metacharacters (e.g., ;, |, &&, $()). Monitor for anomalous outbound network traffic from the routers, such as connections to unknown command-and-control (C2) servers or participation in scanning activity.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Restrict access to the device's web management interface to a dedicated, trusted administrative network segment.
• Ensure the management interface is not exposed to the internet.
• Deploy a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) with rules to detect and block command injection attempts targeting the 'ping_addr' parameter.

Public Exploit Available: true

Given the high severity of this vulnerability and the public availability of exploit code, we recommend immediate and urgent action. All internet-facing NuCom devices should be patched or taken offline immediately. For internal devices, patching should be prioritized as a critical action. If patching cannot be performed immediately, the compensating controls listed above, particularly restricting access to the management interface, must be implemented without delay to reduce the attack surface.