This vulnerability in WePresent WiPG-1000 firmware (pre-2.2.3.0) involves improper neutralization of special elements in the Client parameter passed to a system call via the undocumented /cgi-bin/rdfs.cgi endpoint. Because the input is not sanitized, an unauthenticated remote attacker can inject OS commands that execute with the privileges of the web server user. The CVSS 4.0 base score of 9.3 reflects the vulnerability's network attack vector, lack of required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device as the web server user. This can lead to full compromise of the device, unauthorized access to sensitive information, disruption of device functionality, and potential pivoting within the network. The high CVSS score and critical severity indicate a severe security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device, especially to the /cgi-bin/rdfs.cgi endpoint, to trusted users only. Monitor for unusual activity related to this endpoint. Do not expose the device directly to untrusted networks.