An issue in the gateway server component of mpush version 0.8.1 permits the execution of arbitrary code when an attacker sends a specially crafted broadcast message. The flaw appears to arise because the gateway processes these messages without performing appropriate validation or sanitization before executing content. Based on the description, it is inferred that the malicious payload would be executed with the same privileges as the gateway process, providing full control over the affected server.

The vulnerability affects mpush gateway servers running version 0.8.1. No additional vendor or product details are available beyond the name of the mpush gateway component.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack seems to require network access to the gateway’s broadcast interface; based on the description it is inferred that an attacker can trigger the flaw by sending a crafted broadcast message over the network. Because any host that can reach the broadcast interface could potentially exploit the issue, the risk is considered high‑risk remote code execution.