A critical OS command injection vulnerability in the OpenMediaVault openmediavault-md plugin enables unauthenticated remote attackers to gain full root-level control over the host system.

This vulnerability is an OS command injection flaw located within the openmediavault-md plugin. It allows an unauthenticated attacker to inject shell metacharacters, leading to arbitrary code execution with root privileges.

The potential for unauthenticated remote code execution with root privileges represents the highest level of security risk to the organization. A successful exploit would allow an attacker to compromise the entire storage system, exfiltrate sensitive data, or deploy malicious payloads, resulting in total system compromise. Given the CVSS score of 9.8, this vulnerability must be treated as an immediate, mission-critical priority.

Immediate Action: Until an official security patch is released by the vendor, administrators should disable or uninstall the openmediavault-md plugin to remove the vulnerable attack vector.

Proactive Monitoring: Monitor system logs for unusual process executions, specifically looking for shell-related commands or unexpected activity originating from the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system configured to block requests containing common shell metacharacters, though this should be considered a temporary measure until the plugin is removed or patched.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the vulnerability references.

Due to the critical nature of this vulnerability and the availability of a public proof-of-concept, immediate action is required. Organizations should identify and disable the affected openmediavault-md plugin across all deployments to prevent unauthorized root access. Monitor official vendor channels for the release of a security update and verify the environment against any signs of prior unauthorized access.