A critical CSV injection vulnerability exists in Archer 6, which could allow an attacker to achieve arbitrary code execution on a user's machine.

This vulnerability is a form of CSV injection where crafted system inputs are exported into CSV files, leading to command execution when the file is opened by a user. The attack is unauthenticated, as it relies on the processing of malicious data exported from the system.

The potential for remote code execution poses a severe risk to organizational security, as an attacker could compromise individual workstations or gain a foothold within the corporate network. With a CVSS score of 8.8, this flaw represents a high risk of total impact to confidentiality, integrity, and availability for affected users.

Immediate Action: Restrict the ability of untrusted users to input data that may be exported into CSV reports until a formal vendor patch is released.

Proactive Monitoring: Review application logs for suspicious input patterns and monitor endpoint security software for unauthorized process execution following the opening of exported CSV files.

Compensating Controls: Deploy endpoint protection solutions that alert on or block the execution of command shells spawned by common spreadsheet applications.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up hosted on GitHub.

Given the high severity of this vulnerability and the availability of public proof-of-concept code, organizations should treat this with urgency. Administrators must implement strict input validation or restrict export functionality until the vendor provides a definitive security update to neutralize the injection vector.