CyberRota Analysis
AI-GeneratedThe vulnerability in MOOS-IvP iSay allows remote code execution due to the unsanitized handling of the SAY_MOOS variable, enabling attackers to inject shell commands through specially crafted messages. This critical flaw can lead to arbitrary command execution with the privileges of the iSay process user, posing a significant risk to systems utilizing this software. Organizations using MOOS-IvP iSay should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.