A critical Remote Code Execution vulnerability in WGDashboard allows unauthenticated attackers to execute arbitrary commands as root, posing a severe risk of total system compromise.

The vulnerability is an OS Command Injection flaw (CWE-78) occurring within API endpoints, such as /api/updatePeerSettings. Despite the initial description suggesting authentication requirements, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is an unauthenticated vulnerability accessible over the network.

Successful exploitation allows an attacker to gain full root-level control over the host running WGDashboard. Given the 9.8 CVSS score, this represents a critical risk that could lead to complete data exfiltration, persistent unauthorized access, and full system takeover. The potential for immediate and total compromise makes this an urgent priority for any organization utilizing this software.

Immediate Action: Update WGDashboard to the latest available version that addresses these command injection flaws. If an update is not yet available, restrict access to the WGDashboard administrative interface to trusted internal networks only.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /api/updatePeerSettings endpoint. Monitor for unusual processes or child processes spawned by the WGDashboard service that may indicate command injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads containing shell metacharacters or unauthorized system commands within API request parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided references and confirmed by the presence of Nuclei detection templates.

This is a critical vulnerability that requires immediate attention due to the ease of exploitation and the high level of access granted to attackers. Security teams should prioritize patching or implementing network-level access controls immediately to prevent unauthorized root-level command execution.