Satcom Vsat7090 Maritime Satellite Router
Monthly
Remote command injection in Cobham SATCOM VSAT7090 Maritime Satellite Router (all versions through build 20260704) allows low-privileged remote attackers to execute arbitrary OS commands by supplying maliciously crafted sender or recipients values within JSON-parsed mail report configuration. The vulnerable function c_set_reports_decode in mail-report.sh passes these arguments unsanitized to shell commands, yielding full device compromise. A public proof-of-concept exploit exists, the vendor has not responded to coordinated disclosure, and no patch is available - creating an unmitigated remote code execution exposure on an operational maritime communications device.
Remote command injection in Cobham SATCOM VSAT7090 Maritime Satellite Router (all versions through build 20260704) allows low-privileged remote attackers to execute arbitrary OS commands by supplying maliciously crafted sender or recipients values within JSON-parsed mail report configuration. The vulnerable function c_set_reports_decode in mail-report.sh passes these arguments unsanitized to shell commands, yielding full device compromise. A public proof-of-concept exploit exists, the vendor has not responded to coordinated disclosure, and no patch is available - creating an unmitigated remote code execution exposure on an operational maritime communications device.