Description

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T23:16:35.650Z",
  "pubdate": "2026-08-31T23:16:35.650Z",
  "executiveSummary": "A critical command injection vulnerability exists within the RedPort Optimizer wXa-203, wXa-213, and wXa-223 series, specifically affecting the system clock configuration interface.\nThe vulnerability resides in the /xgatev1/system/datetime.php file within the System Clock component, where user-supplied input is improperly sanitized before being passed to an execution function.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary system commands with the privileges of the underlying web server user.\nThis represents a severe security risk, potentially leading to full system compromise, unauthorized data access, persistence establishment, or lateral movement within the network.\nThe vulnerability is currently public, and given the vendor's lack of response, users remain at an elevated risk of exploitation.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input validation and sanitization within the exec function located in /xgatev1/system/datetime.php.\nThe component responsible for managing system time settings fails to correctly treat user-supplied parameters as data, instead allowing them to be interpreted as shell commands.\nAn attacker can leverage this flaw by injecting malicious shell metacharacters (such as backticks, semicolons, or pipes) into the input fields processed by the datetime.php script.\nThe exploitation flow begins with a crafted HTTP request directed at the affected endpoint. By appending malicious command sequences to the expected parameters, the attacker forces the underlying operating system to execute commands injected via the exec function.\nBecause the function call does not restrict the context of the input, the attacker gains the ability to execute shell-level operations.\nThe vulnerability is remotely exploitable, requiring no prior authentication. It affects RedPort Optimizer wXa-203, wXa-213, and wXa-223 models running firmware versions up to 20260704.\nPost-exploitation, the impact is significant; an attacker can perform arbitrary file system manipulation, exfiltrate sensitive configuration data, deploy web shells for persistence, or utilize the compromised device as a pivot point to attack other internal systems.\nThe lack of sanitization essentially creates a blind or reflected command injection vector that bypasses application-level security controls, effectively granting the attacker the same command execution capabilities as the web server service account."
}