CyberRota Analysis
AI-GeneratedA command injection vulnerability exists in the ArmAngstromInstructionSet function of the ICP DAS UA-2200 and UA-5200 devices, specifically when manipulating the ParameterArray argument via the /CGI?RestApi=SetHostname endpoint. This flaw allows remote attackers to execute arbitrary commands, posing a significant risk to the integrity and security of the affected systems. Organizations using these devices should prioritize patching or mitigating this vulnerability to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.