OS command injection in the CWMP client (/ftl/bin/cwmp) of Sercomm SCE4255W firmware allows an attacker with control over the ACS endpoint to execute arbitrary shell commands as root. This flaw results in full system compromise, enabling compromise of confidentiality, integrity and availability of the device. The vulnerability is classified as CWE‑94 and carries a CVSS score of 9.8.

The affected devices are Small Cell Sercomm SCE4255W units, marketed as FreedomFi Englewood. Firmware versions prior to DG3934v3@2308041842 are vulnerable. No specific CNA vendor/product identifiers were provided, but the devices are listed in the FCC report and related community advisories.

The flaw poses a high risk with a CVSS score of 9.8 and an EPSS likelihood of less than 1 %. It is not currently listed in the CISA KEV catalog. The exploit requires remote access to the ACS endpoint and the ability to craft a TR‑069 Download URL that is passed unescaped into the firmware upgrade pipeline. The attack vector is thus remote, and only customers exposing their ACS to untrusted networks are at immediate risk. Due to the low exploit probability, widespread exploitation has not been reported, but the severity warrants swift action.