A critical command injection vulnerability in the Cobham SATCOM VSAT7090 Maritime Satellite Router allows remote attackers to gain full system control.

The vulnerability exists within the c_set_reports_decode function of the mail-report.sh file due to improper JSON parsing. An authenticated attacker can manipulate the sender or recipient arguments to trigger remote command injection on the device.

The exploitation of this vulnerability leads to a complete compromise of the satellite router, which facilitates unauthorized access to sensitive maritime communications and network infrastructure. Given the critical CVSS score of 9.9, this flaw poses an extreme risk, as it allows for persistent system-level control, data exfiltration, and potential disruption of critical operational services.

Immediate Action: As the vendor has not yet provided a patched version, administrators must restrict network access to the management interface of the VSAT7090 router to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or unusual command-line arguments originating from the mail-report.sh component.

Compensating Controls: Implement strict Web Application Firewall (WAF) or Network Intrusion Detection System (NIDS) rules to inspect and block malicious JSON payloads targeting the mail-report.sh endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided via the Feishu reference.

Due to the critical severity and the public availability of exploit details, immediate mitigation is required. Organizations utilizing the Cobham SATCOM VSAT7090 should prioritize isolating these devices from external networks and strictly limiting administrative access until the vendor releases a formal security update.