This vulnerability affects the GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1). An unauthenticated attacker can inject operating system commands through the /action/SetRemoteAccessCfg endpoint, exploiting improper input validation (CWE-78) and lack of authentication (CWE-306). The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No patch or vendor remediation information is provided.

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device's confidentiality and integrity. Availability impact is not indicated. This could enable attackers to manipulate device configuration or gain unauthorized control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device's management interface to trusted users only and monitor for suspicious activity targeting the /action/SetRemoteAccessCfg endpoint. Avoid exposing the device management interface to untrusted networks.