Upsnap
Monthly
Unauthenticated superuser takeover in UpSnap 4.4.1 through 5.3.5 lets a network attacker seize an un-provisioned instance by calling POST /api/upsnap/init-superuser, which is guarded only by a totalSuperusers > 0 check that is always false on a fresh install. After registering the first admin and obtaining a long-lived JWT, the attacker abuses UpSnap's device wake/shutdown command feature to reach exec.CommandContext("/bin/sh","-c", ...) and execute shell commands as the server user (root in typical container deployments). No KEV listing and no public exploit identified at time of analysis; the fix is in 5.4.0.
Authenticated remote code execution in UpSnap (a self-hosted Wake-on-LAN web app) before 5.4.0 lets any low-privileged user with device create/edit permission run arbitrary OS commands on the server. User-supplied device IP and MAC values are interpolated into the wake_cmd/shutdown_cmd shell templates and passed unsanitized to /bin/sh -c on Linux or cmd /C on Windows, giving full command execution in the app's process context. No public exploit was identified at time of analysis and it is not in CISA KEV, but the flaw is trivially triggerable at low attack complexity once an account exists; a companion setup-wizard flaw (GHSA-w4jr-728f-5jhq) can let an attacker seize the first superuser on un-provisioned public instances and chain into this RCE.
Unauthenticated superuser takeover in UpSnap 4.4.1 through 5.3.5 lets a network attacker seize an un-provisioned instance by calling POST /api/upsnap/init-superuser, which is guarded only by a totalSuperusers > 0 check that is always false on a fresh install. After registering the first admin and obtaining a long-lived JWT, the attacker abuses UpSnap's device wake/shutdown command feature to reach exec.CommandContext("/bin/sh","-c", ...) and execute shell commands as the server user (root in typical container deployments). No KEV listing and no public exploit identified at time of analysis; the fix is in 5.4.0.
Authenticated remote code execution in UpSnap (a self-hosted Wake-on-LAN web app) before 5.4.0 lets any low-privileged user with device create/edit permission run arbitrary OS commands on the server. User-supplied device IP and MAC values are interpolated into the wake_cmd/shutdown_cmd shell templates and passed unsanitized to /bin/sh -c on Linux or cmd /C on Windows, giving full command execution in the app's process context. No public exploit was identified at time of analysis and it is not in CISA KEV, but the flaw is trivially triggerable at low attack complexity once an account exists; a companion setup-wizard flaw (GHSA-w4jr-728f-5jhq) can let an attacker seize the first superuser on un-provisioned public instances and chain into this RCE.