The vulnerability arises because the IE-SR-2TX-WL device's web-based management interface uses a modified uhttpd server with CGI shell scripts that incorporate the HTTP Basic Authentication username directly from the Authorization header into a shell command string executed by the system() function without sanitization. This improper neutralization of special elements (CWE-78) enables an unauthenticated attacker with network access to the device to escape the intended command context and execute arbitrary commands with root privileges by submitting a specially crafted username containing shell metacharacters.

An unauthenticated attacker with network access can exploit this vulnerability to execute arbitrary commands on the device with root privileges. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of device functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict network access to the device's management interface to trusted sources only to reduce exposure.