Optimizer Wxa 203
Monthly
Command injection in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices (firmware through 20260704) allows low-privileged remote attackers to execute arbitrary OS commands via the System Clock management endpoint. The vulnerable `exec()` call in `/xgatev1/system/datetime.php` accepts unsanitized user input, enabling shell metacharacter injection. A public proof-of-concept exploit has been disclosed via Feishu, the vendor did not respond to responsible disclosure, and no patch has been released, leaving operators without an official remediation path.
Command injection in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices (firmware through 20260704) allows low-privileged remote attackers to execute arbitrary OS commands via the System Clock management endpoint. The vulnerable `exec()` call in `/xgatev1/system/datetime.php` accepts unsanitized user input, enabling shell metacharacter injection. A public proof-of-concept exploit has been disclosed via Feishu, the vendor did not respond to responsible disclosure, and no patch has been released, leaving operators without an official remediation path.