The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) contains an unauthenticated OS command injection vulnerability accessible through the /action/SetRemoteAccessCfg endpoint. This vulnerability allows remote attackers to execute arbitrary operating system commands without authentication, potentially compromising the confidentiality and integrity of the affected device. The CVSS 3.1 base score is 9.1, reflecting the critical nature of this flaw. No vendor advisory or patch information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, leading to full compromise of the device's confidentiality and integrity. Availability impact is not indicated. This could result in unauthorized control or data disclosure from the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially to the /action/SetRemoteAccessCfg endpoint, to trusted users only. Monitor for any updates from the vendor regarding patches or mitigations.