The vulnerability allows a remote attacker with privileged access to upload and execute arbitrary files on the PrismX MX100 AP controller. By uploading a web shell or other malicious payload, an attacker can run code on the device, potentially compromising the entire network that relies on that controller for management and configuration. This flaw is an arbitrary file upload weakness that elevates local or remote threats to full system compromise.

BROWAN COMMUNICATIONS PrismX MX100 AP controller is affected when running firmware prior to version v1.03.23.01. No other versions or products were identified as impacted based on the current data.

The CVSS score of 8.6 indicates a high severity with wide scope and full privilege escalation potential. The EPSS score of less than 1% suggests that, as of the latest assessment, exploitation attempts are rare, but the presence of a documented web shell means that the vulnerability can be abused when an attacker gains the necessary privileges. The issue is not yet listed in the CISA Known Exploited Vulnerabilities catalog, so no active exploit campaigns are reported. The likely attack vector requires remote privileged access, potentially through maintenance interfaces or default credentials, which an attacker could leverage to upload malicious files that execute with system privileges.