UTMStack prior to version 11.2.16 lacks a critical authorization check in the UTMIncidentCommandWebsocket.processCommand() handler. This endpoint, exposed on the /command/{hostname} STOMP destination, forwards user‑supplied command strings to any connected agent over gRPC without verifying the caller’s role or applying a command allow‑list. As a result, any authenticated user, even those with low privileges, can execute arbitrary operating‑system commands on any monitored endpoint. Since the agents typically run with root or SYSTEM privileges, this flaw effectively provides attackers with full control over the endpoints.

All UTMStack deployments running 11.2.15 or earlier are vulnerable. The product affected is UTMStack, and any installation using a pre‑11.2.16 release is susceptible to the missing authorization flaw.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers only need valid user credentials to exploit the flaw, which removes the need for privileged roles. Because the flaw allows arbitrary command execution on agents running as root, the potential impact is high, especially in environments where the agent binary has elevated privileges or where the gRPC channel is accessible from untrusted network segments. The attack vector is internal since it relies on authentication; however, compromised credentials or social engineering can easily provide the required access. Overall, the risk is significant for organizations using older UTMStack releases.