A critical OS command injection vulnerability in I-O DATA WN-7D36QR series devices allows authenticated remote attackers to achieve arbitrary code execution on the affected hardware.

This is an OS command injection vulnerability (CWE-78) occurring in the device firmware. It requires the attacker to have valid authentication (authenticated) to trigger the injection, which then allows for the execution of arbitrary OS commands.

A successful exploit grants an attacker the ability to execute arbitrary commands at the system level. This compromise leads to a total loss of confidentiality, integrity, and availability for the affected network device. Given the CVSS score of 7.2, this vulnerability represents a significant risk to network infrastructure, potentially allowing attackers to pivot into internal segments or intercept sensitive traffic passing through the hardware.

Immediate Action: Update the firmware of all affected WN-7D36QR and WN-7D36QR/UE devices to the latest available version provided by I-O DATA.

Proactive Monitoring: Monitor device logs for unusual administrative activity or suspicious shell command patterns that deviate from standard operational behavior.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only, ensuring that only authorized personnel can reach the vulnerable entry points.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized system control. Administrators must prioritize the application of the vendor-supplied firmware update across all deployed units. Failure to patch these devices leaves the network susceptible to full administrative compromise by any attacker who obtains valid credentials.