The vulnerability is a missing‑authentication and privilege‑escalation chain in UpSnap's `pb.HandlerInitSuperuser` endpoint. Because the endpoint lacks authentication, a setup token, IP allow‑list, or rate limit and only checks that the system has zero superusers, an unauthenticated network‑adjacent attacker can register the first superuser, obtain a long‑lived JWT, and then use that credential to invoke `exec.CommandContext(..., wake_cmd)` in the wake module, which launches a shell under the root user. This results in remote code execution and full administrative control of the host.

The affected product is the UpSnap wake‑on‑LAN web application. Vulnerable versions are 4.4.1 through 5.3.5; these release builds allow the unauthenticated registration of the initial superuser. Version 5.4.0 fixes the issue by adding appropriate authentication, token, or rate‑limit controls.

The CVSS score is 9.8, which is classified as critical. EPSS is not available and the vulnerability is not currently listed in the CISA KEV catalog. The absence of authentication combined with the fact that the endpoint is accessible from any device on the same network makes the attack vector likely network‑adjacent. Although no public exploitation code is publicly documented, the high impact and ease of exploitation indicate a high priority for mitigation.