An authenticated remote code execution vulnerability exists in ZesleCP 3.1.9, allowing an attacker to execute arbitrary system commands via a malicious FTP account creation payload.

This flaw is an OS command injection vulnerability (CWE-78) triggered through the FTP account creation endpoint. An authenticated attacker can inject shell commands into the FTP password field, which are then executed by the underlying operating system.

A successful exploit grants the attacker the ability to execute arbitrary commands with the privileges of the web application user. This level of access typically results in total system compromise, allowing attackers to exfiltrate sensitive data, manipulate hosted websites, or establish persistence within the infrastructure. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational confidentiality, integrity, and availability.

Immediate Action: There is no official patch currently documented for this specific vulnerability. Administrators should restrict access to the ZesleCP management interface to trusted IP addresses only and consider disabling the FTP account creation feature until a vendor-supplied security update is applied.

Proactive Monitoring: Security teams should audit system logs for unusual process spawning, especially those originating from web server accounts or involving network connections to unknown remote listeners. Monitor for unauthorized creation of FTP accounts or unexpected modifications to system configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block command injection patterns within JSON payloads sent to the core FTP management endpoints. Implement strict network segmentation to limit the impact if the web application is compromised.

Public Exploit Available: Yes, a functional exploit script and proof-of-concept are available via ExploitDB (EDB-ID: 50233).

Due to the availability of public exploit code and the severe impact of remote code execution, this vulnerability poses a significant threat to any environment running ZesleCP. Administrators must prioritize isolating the affected management interface immediately. As no official patch is available, rigorous monitoring and the application of compensating controls are necessary to mitigate the risk of unauthorized system access.