A critical command injection vulnerability in RedPort Optimizer devices allows remote attackers to execute arbitrary system commands, posing a severe risk of full system compromise.

This vulnerability involves improper neutralization of special elements used in an OS command (CWE-77) within the exec function of the /xgatev1/system/datetime.php file. The vulnerability is remotely exploitable by an authenticated user with low privileges, resulting in full system-level command injection.

Successful exploitation of this vulnerability allows for complete control over the affected RedPort Optimizer hardware. Given the CVSS 4.0 score of 9.9, the impact includes potential unauthorized access to satellite communication traffic, data exfiltration, and the ability to pivot into connected internal networks. This represents a critical risk to operational continuity and information security.

Immediate Action: Apply the vendor-provided firmware update immediately to version 20260704 or later to patch the vulnerable datetime.php component.

Proactive Monitoring: Monitor system logs for unusual process execution or shell commands originating from the web interface, specifically targeting traffic to the /xgatev1/system/datetime.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize input parameters sent to the datetime.php script, and restrict access to the device management interface to trusted internal IP addresses only.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability disclosure reference.

The severity of this flaw, combined with the lack of vendor responsiveness in some channels, necessitates immediate patching. Organizations utilizing the affected RedPort Optimizer models should prioritize this update as part of their urgent maintenance cycle to prevent unauthorized remote code execution.