Description

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-01T06:16:38.107Z",
  "pubdate": "2026-09-01T06:16:38.107Z",
  "executiveSummary": "This vulnerability involves a critical command injection flaw identified within the JSON parsing logic of the Cobham SATCOM VSAT7090 Maritime Satellite Router. The vulnerability resides in the c_set_reports_decode function within the mail-report.sh shell script. By manipulating the sender or recipients arguments during the JSON decoding process, an unauthenticated remote attacker can inject arbitrary shell commands, which are subsequently executed by the system with elevated privileges. The impact of this vulnerability is severe, potentially leading to full system compromise, unauthorized data access, and disruption of critical maritime satellite communication services. Given that the exploit is currently public and the vendor has remained unresponsive to disclosure efforts, the risk to operational deployments is extreme. No specific authentication is required to trigger this flaw, facilitating remote exploitation over the network.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of input validation and sanitization within the c_set_reports_decode function located in the mail-report.sh script. This component is responsible for parsing incoming JSON objects related to mail reporting functionality. During the decoding of the 'sender' or 'recipients' fields, the script fails to adequately escape shell metacharacters, effectively allowing user-controlled input to be concatenated directly into a system shell command execution chain.\nThe exploitation process initiates when an attacker crafts a malicious JSON payload containing command separators (such as ';', '|', or '&&') embedded within the 'sender' or 'recipients' parameters. When the VSAT7090 router receives this JSON data, the vulnerable mail-report.sh script passes the unsanitized input to a system call—likely an exec or popen-style invocation—expecting to process email metadata. Because the input is not sanitized, the system interprets the injected characters as instruction delimiters rather than data strings, leading to the execution of arbitrary commands within the shell context of the router.\nThe vulnerable component, identified as the JSON Parsing module, does not implement necessary constraints on the characters permitted in the specified fields. The scope of impact includes any command the service process is authorized to execute. In typical embedded maritime router architectures, this often translates to root-level access, allowing an attacker to modify configuration files, exfiltrate sensitive network traffic, pivot into internal maritime networks, or render the satellite communications interface inoperable.\nNetwork exposure is significant as the component is reachable remotely, enabling attackers to target satellite terminals without prior authentication or local access. The exploitation does not appear to require complex bypasses, as the flaw is a direct consequence of unsafe shell invocation patterns. Post-exploitation, an attacker can maintain persistence on the router, monitor satellite uplink/downlink activities, and potentially bypass firewall rules by modifying the underlying operating system environment. As this vulnerability affects firmware versions up to 20260704, all devices currently in deployment are at risk until the underlying shell scripting logic is refactored to utilize safe APIs that do not invoke the shell directly or until strict input validation schemas are enforced on all JSON-derived inputs."
}