Passy Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in Passy version 1.6.3. This issue allows remote authenticated attackers to execute arbitrary commands by injecting special characters into form input fields to chain multiple commands together. The application operates with root privileges, posing a significant security risk. Exploitation of this vulnerability could enable an attacker to physically open controlled gates by sending unauthorized commands through the serial interface, using a specific code sequence.

Impact

Exploitation of this vulnerability allows for remote code execution with root privileges, creating a critical security risk by enabling unauthorized access and control over the system.