A critical Cross-Site Request Forgery vulnerability in the Narda MITEQ UPC2 allows unauthenticated remote code execution, posing a severe risk to device integrity.

This flaw is a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to trigger administrative actions, including arbitrary code execution, by tricking a user into interacting with malicious links. The vulnerability affects multiple endpoints, including /system_setup.htm, /set_clock.htm, /receiver_setup.htm, /cal.htm, and /channel_setup.htm.

Successful exploitation allows a remote attacker to gain unauthorized control over the Uplink Power Control Unit. Given the device's function in critical communication infrastructure, this could lead to total system compromise, unauthorized configuration changes, or complete service disruption. The CVSS score of 8.8 reflects the high potential for full system impact despite the requirement for user interaction.

Immediate Action: Since no official patch version is currently identified, administrators should restrict access to the web-based management interface of the UPC2 to trusted internal networks only.

Proactive Monitoring: Monitor device access logs for suspicious requests originating from unauthorized sources or unexpected administrative activity during off-peak hours.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network security control to validate and filter incoming requests to the management interface, specifically targeting the identified vulnerable endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the technical write-up provided in the referenced research materials.

This vulnerability presents a significant risk due to the potential for full system compromise via remote code execution. Administrators must isolate the affected hardware from the public internet immediately and restrict management access to segmented, secure networks until the manufacturer provides a formal firmware update to address these insecure endpoints.