This vulnerability is caused by improper input handling in the sub_40F820 routine of the FBM-220G firmware. The routine accepts the parameters upnp_waniface, upnp_ssdp_interval, and upnp_max_age and forwards them directly to the underlying system without validation, resulting in a command injection flaw. An attacker can send crafted values for these parameters over the remote interface, allowing arbitrary shell commands to be executed on the device. The weakness represents a command injection (CWE-77) and command and regular expression injection (CWE-74) vulnerability.

The affected product is the WAYOS FBM-220G broadband modem. Firmware version 24.10.19 includes the vulnerable sub_40F820 implementation. This version is the only one indicated in the advisory.

CVSS base score 5.3 indicates moderate severity. The EPSS score of 2% is relatively low but demonstrates that the vulnerability has a tangible likelihood of exploitation in the wild. The attack vector is remote, as the exploit is triggered through the UPnP interface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw allows arbitrary command execution, the potential impact ranges from service disruption to full device compromise if an attacker is able to use downstream networking functions. The lack of vendor remediation in the advisory further increases the risk for current deployments.