Panabit PAP-XM320 Command Injection Vulnerability in Web Management Interface

A command injection vulnerability has been identified in Panabit PAP-XM320 versions up to and including V7.7. The issue arises in the web management interface, which calls a backend helper and transmits user-controlled parameters. This helper processes arguments unsafely using eval, creating an opportunity for command injection when attacker-controlled input is included. Consequently, an authenticated remote attacker with access to the management interface could execute arbitrary shell commands.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system.