Sxzos
Monthly
Unauthenticated remote code execution as root in Xspeeder SXZOS lets any attacker who can reach the device's login/management interface run arbitrary Python with full system privileges by supplying base64-encoded code in the chkid parameter of vLogin.py (the title and oIP parameters are also injectable). All SXZOS builds through 2025-12-26 are affected per the wildcard CPE, and exploitation requires no authentication, no user interaction, and no non-default configuration - only network reachability. Publicly available exploit code exists, and the public analysis claims roughly 70,000 exposed hosts, making this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case; no CISA KEV listing is present in the provided data, and EPSS was not supplied.
Unauthenticated remote code execution as root in Xspeeder SXZOS lets any attacker who can reach the device's login/management interface run arbitrary Python with full system privileges by supplying base64-encoded code in the chkid parameter of vLogin.py (the title and oIP parameters are also injectable). All SXZOS builds through 2025-12-26 are affected per the wildcard CPE, and exploitation requires no authentication, no user interaction, and no non-default configuration - only network reachability. Publicly available exploit code exists, and the public analysis claims roughly 70,000 exposed hosts, making this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case; no CISA KEV listing is present in the provided data, and EPSS was not supplied.