RedPort Optimizer CVE-2026-83524

Exploitation requires a valid low-privilege authenticated session on the RedPort Optimizer web management interface, as indicated by PR:L in the CVSS 4.0 vector. The vulnerable code path is the System Clock configuration feature, accessed via the endpoint /xgatev1/system/datetime.php; this endpoint must be reachable over the network, which is the default posture for these management interfaces. No non-default configuration is required - the System Clock feature is a standard component of all three named device models. Exploitation is bounded by the PR:L credential requirement: an attacker must possess or obtain at least one valid user account on the device. Unauthenticated exploitation is not supported by the available CVSS data. Network-layer segmentation (e.g., firewall rules limiting management interface access) is the primary environmental factor that would limit exposure.

The CVSS 4.0 base score of 8.6 reflects a network-reachable, low-complexity attack path requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems - the SC:H/SI:H/SA:H metrics indicate the compromise can propagate beyond the device itself to connected WAN or satellite network segments. The publicly available proof-of-concept substantially accelerates real-world exploitation risk, and even a mid-sized maritime IT team in sopot managing a modest fleet of these appliances should treat this as urgent given that the vendor's non-response to disclosure eliminates any near-term patch timeline. The vulnerability is not currently listed in CISA KEV, suggesting broad confirmed exploitation has not yet been observed, but the absence of a vendor patch combined with PoC availability creates a sustained high-risk window. The PR:L prerequisite - requiring at least a low-privilege account - constrains purely opportunistic mass exploitation but is a weak barrier against targeted attacks on operators who share or reuse default credentials.

An attacker with a valid low-privilege account on the RedPort Optimizer management interface submits a crafted HTTP request to /xgatev1/system/datetime.php, embedding shell metacharacters (e.g., semicolons or backticks) in the datetime field, causing the backend exec() call to execute attacker-controlled OS commands on the appliance. The publicly disclosed proof-of-concept, referenced in the Feishu document linked in VulDB entry 397374, demonstrates this technique step-by-step, enabling exploitation without deep vulnerability research. Successful exploitation can yield persistent backdoor installation, credential harvesting, or use of the device as a pivot point into connected satellite WAN infrastructure.