RustFly 2.0.0 includes a command injection flaw in its remote User Interface that processes hex‑encoded instructions received over UDP port 5005. Unsanitized input allows attackers to embed arbitrary system commands in the payload, which the device then executes. This flaw can be used to run commands locally, including the deployment of a reverse shell, thereby compromising the confidentiality, integrity, and availability of the affected system.

The only documented affected version is Bixat RustFly firmware 2.0.0. No additional product versions or releases are listed as vulnerable.

Based on the description, the attack vector is remote network access to UDP port 5005. The CVSS score of 9.3 denotes a critical severity, while the EPSS score of < 1 % indicates a very low likelihood of exploitation in the wild. Although widespread abuse is not yet documented and the flaw is not listed in CISA’s KEV catalog, the impact of successful exploitation—arbitrary local command execution including reverse shells—would severely compromise confidentiality, integrity, and availability of the device.