An OS command injection vulnerability in the Curo UC300 admin panel allows authenticated attackers to achieve full system compromise.

This is an OS command injection flaw located in the admin panel interface. It allows an attacker with low-level administrative privileges to inject arbitrary operating system commands through the IP Addr parameter.

The ability to execute arbitrary OS commands provides an attacker with complete control over the affected appliance. Given the CVSS score of 8.8, this vulnerability poses a severe risk of data exfiltration, unauthorized network pivot, and total loss of device integrity, which could lead to significant operational disruption.

Immediate Action: Restrict access to the administrative panel to trusted internal networks only until a vendor patch is released and applied.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns or unexpected shell invocations originating from the administrative interface.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to sanitize or block input containing shell metacharacters within the IP Addr parameter field.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repository.

Given the high CVSS score and the public availability of a proof-of-concept, this vulnerability must be treated with high urgency. Administrators should limit exposure of the management interface immediately and prepare to apply security updates as soon as the vendor provides a resolution.