An unauthenticated remote code execution vulnerability in the Epross AVCON6 platform allows attackers to execute arbitrary commands with root privileges via OGNL injection.

The application is vulnerable to OGNL injection (CWE-1334) through the redirect parameter in the login.action endpoint. This allows unauthenticated attackers to instantiate ProcessBuilder objects and execute system-level commands with root privileges.

This vulnerability grants an attacker full control over the affected system with the highest level of privilege. A successful exploit could lead to complete data exfiltration, system destruction, or the deployment of persistent malware, causing severe reputational and operational damage.

Immediate Action: Apply the latest security updates provided by the vendor. If no patch is available, disable the affected management platform functionality.

Proactive Monitoring: Inspect server logs for anomalous requests containing OGNL patterns or attempts to manipulate the redirect parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block OGNL expression patterns and suspicious redirect parameters targeted at the login endpoint.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (47379).

The combination of unauthenticated access, root-level command execution, and the availability of a public exploit makes this a high-priority risk. Organizations must ensure that the management interface is not exposed to the internet and apply vendor-supplied patches immediately upon availability.