This vulnerability affects the Generic OEM UZ801_v2.1 4G LTE Router version 3.4.3. A remote attacker can exploit the /ajax web management API endpoint in the MifiService.apk to execute arbitrary code without authentication. The issue is classified under CWE-94, indicating improper control over code generation or execution. The CVSS v3.1 base score is 9.8, reflecting critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected device, potentially leading to full system compromise, including complete loss of confidentiality, integrity, and availability of the device and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's web management interface to trusted networks only and monitor for unusual activity. Avoid exposing the management interface to untrusted networks.