The Atlona AT-OME-MS42 Matrix Switcher 1.1.2 contains a flaw in the /cgi-bin/time.cgi handler that allows an authenticated user to send a crafted POST request containing a serverName parameter. This flaw enables the remote execution of arbitrary commands on the device’s operating system with root privileges.

Atlona AT-OME-MS42 Matrix Switcher running firmware version 1.1.2.

This vulnerability provides a direct path for authenticated users to execute any command as root. Because the flaw is triggered by a simple HTTP POST request over the network, an attacker who can gain valid authentication credentials can compromise the entire device. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is unknown, but the impact of root-level execution is severe. The likely attack vector is an authenticated remote request to the affected CGI endpoint.