The SAPIDO RB‑1732 router firmware version 2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. The flaw is identified as CWE‑639 in the provided data. An attacker can send a POST request with the sysCmd parameter containing shell commands, causing the device to run those commands with router privileges, potentially giving full control over the system.

Affected systems are SAPIDO RB‑1732 routers running firmware version 2.0.43. No other versions or product families are listed in the CNA data, so only the specified build is confirmed vulnerable.

The CVSS score of 9.3 marks this vulnerability as critical. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP POST to the formSysCmd endpoint; exploitation requires only network reachability to the device. Successful exploitation results in remote code execution with administrative privileges, giving the attacker full control over the device’s operating system.