Description

A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-01T11:16:45.493Z",
  "pubdate": "2026-09-01T11:16:45.493Z",
  "executiveSummary": "A critical command injection vulnerability exists in ICP DAS UA-2200 and UA-5200 series devices, affecting firmware versions up to 20260704.\nThe vulnerability resides within the ArmAngstromInstructionSet function located in the /CGI?RestApi=SetHostname component.\nBy manipulating the ParameterArray argument, a remote, unauthenticated attacker can execute arbitrary system commands with the privileges of the underlying web service.\nThis flaw poses a severe security risk as it allows for full system compromise, unauthorized data access, or the deployment of persistent malicious payloads.\nThe vulnerability is remotely exploitable, requiring only network connectivity to the affected device's management interface.\nPublicly available exploit code increases the probability of successful attacks by malicious actors.\nThe vendor has been notified but has failed to provide a responsive disclosure or remediation path.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw located in the /CGI?RestApi=SetHostname CGI script. The root cause is the insecure handling of user-supplied input within the ArmAngstromInstructionSet function, which fails to adequately sanitize or validate data passed through the ParameterArray argument.\nWhen the web server processes requests sent to the specified CGI endpoint, the ArmAngstromInstructionSet function processes the ParameterArray parameter. The implementation incorrectly passes this input directly into a system-level command execution routine or shell interpreter without proper escaping or parameterization. This behavior allows an attacker to inject shell metacharacters such as ';', '&&', or '|' to terminate the intended command and append arbitrary malicious instructions.\nThe attack flow begins with the attacker constructing a crafted HTTP request (typically a POST request) targeting the /CGI?RestApi=SetHostname endpoint. The attacker includes a malicious payload within the ParameterArray field that, when processed, is executed by the device's operating system with the privileges of the web server process (usually root or a high-privilege service account).\nBecause this endpoint is accessible over the network, exploitation does not require prior authentication, making the device exposed to any actor with reach to the management interface. The payload behavior allows for a wide range of post-exploitation activities, including the modification of system configurations, exfiltration of sensitive information, establishment of reverse shells, or the installation of backdoors to facilitate persistence.\nThe lack of input validation within ArmAngstromInstructionSet means the application cannot distinguish between legitimate configuration parameters and malicious command injection vectors. Given that the vendor has not provided a patch for versions up to 20260704, the system remains in a vulnerable state where traditional input filtering is absent, leaving the command shell exposed to external manipulation via the CGI interface."
}