A critical OS command injection vulnerability in Jointelli 5G CPE 21H01 firmware allows authenticated attackers to achieve root-level command execution, posing a significant risk to network infrastructure.

The device is susceptible to OS command injection across multiple endpoints, including the WPS, SSID, Traceroute, and Ping configuration fields. While the CVSS vector indicates network access, the vulnerability requires an authenticated attacker to provide crafted input that the system fails to sanitize before execution.

Successful exploitation allows an attacker to gain full administrative control over the affected hardware, which can lead to complete device compromise, unauthorized network traffic interception, or the use of the device as a foothold for lateral movement within the internal network. Given the CVSS score of 7.4, the high potential for total system impact necessitates immediate attention to prevent unauthorized access to critical communication infrastructure.

Immediate Action: Contact the vendor or monitor the official support portal for the release of a firmware patch that addresses these command injection flaws. If a patch is not yet available, restrict administrative access to the device management interface to trusted internal segments only.

Proactive Monitoring: Review device access logs for unusual activity, specifically looking for shell-like syntax or unexpected characters within configuration parameters related to WPS, Wi-Fi, or diagnostic tools.

Compensating Controls: Implement strict network segmentation and utilize a firewall to restrict access to the web-based management interface, ensuring it is not exposed to the public internet.

Public Exploit Available: Yes, a published proof-of-concept exists (documented in the researcher's technical write-up linked in the references).

The severity of this vulnerability is high due to the potential for root-level command execution on network infrastructure hardware. Organizations must prioritize restricting access to the management interfaces of these devices immediately and should remain vigilant for vendor-supplied firmware updates to address the underlying injection flaws.