A critical remote code execution vulnerability in dnsmgr permits unauthenticated attackers to compromise affected systems with total impact.

The application fails to properly sanitize input in the ping function of the CheckUils.php file, allowing an unauthenticated remote attacker to execute arbitrary system commands.

Successful exploitation of this vulnerability grants an attacker full control over the affected server, leading to potential data exfiltration, system destruction, or lateral movement within the network. Given the CVSS score of 9.8, this flaw represents a critical business risk that could result in significant operational disruption and severe compromise of confidentiality, integrity, and availability.

Immediate Action: There is no official patch available at this time; users should restrict access to the CheckUils.php file or disable the affected dnsmgr component until a security update is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the CheckUils.php endpoint, specifically looking for shell command injection patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing command injection characters or strings directed at the CheckUils.php file.

Public Exploit Available: No.

Due to the critical nature of this vulnerability and the absence of a vendor-supplied patch, immediate containment is required. Administrators must isolate affected dnsmgr instances from the internet and monitor for signs of unauthorized access until a formal update is provided by the vendor.