The vulnerability is an unauthenticated OS command injection in the GoAhead web server running on MeiG Smart FORGE_SLT711 devices. By sending crafted requests to the "/action/SetRemoteAccessCfg" endpoint, an attacker can execute arbitrary operating system commands with the privileges of the web server process. This flaw permits full control over the device and can compromise confidentiality, integrity, and availability of the device and any backend systems it interfaces with.

The affected product is the GoAhead web server bundled in the MeiG Smart FORGE_SLT711 device, specifically firmware version MDM9607.LE.1.0-00110-STD.PROD-1.

The flaw poses a high risk due to its nature as an unauthenticated remote code execution vulnerability. The CVSS score of 9.1 indicates critical severity. The EPSS score of 6% indicates a moderate likelihood of exploitation, and the attack vector can be inferred as network-based as the vulnerable endpoint is exposed over HTTP/HTTPS. The ease of exploitation is high because no authentication is required. The vulnerability is not listed in CISA’s KEV catalog, but the potential impact warrants immediate attention.