Bixat RustFly 2.0.0 is susceptible to unauthenticated remote command injection, posing a critical risk to system integrity.

The vulnerability (CWE-78) stems from improper sanitization of hex-encoded instructions sent over UDP port 5005. This allows an unauthenticated, remote attacker to inject and execute OS-level commands on the underlying system.

With a CVSS score of 9.8, this vulnerability allows for complete system compromise. An attacker could establish reverse shells, exfiltrate sensitive data, or disrupt business operations entirely. The exposure of UDP port 5005 to untrusted networks significantly increases the probability of successful exploitation.

Immediate Action: Update the software to the latest available version provided by the vendor. If an update is unavailable, restrict network access to UDP port 5005 to trusted management IP addresses only.

Proactive Monitoring: Monitor network traffic for unexpected UDP activity on port 5005 and investigate any anomalies in system process execution patterns.

Compensating Controls: Utilize a network firewall to block inbound traffic to the affected UDP port from untrusted external sources.

Public Exploit Available: Yes — a public proof-of-concept is available via VulnCheck and PacketStorm.

Due to the availability of proof-of-concept material and the critical severity of command injection, immediate remediation is required. Organizations should verify their exposure and apply vendor patches or network-level access controls without delay.