CVE-2026-83524: Command Injection in RedPort Optimizer wXa-203

This vulnerability involves command injection in the exec function of the /xgatev1/system/datetime.php file in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices up to the 20260704 version. An attacker can remotely exploit this flaw to execute arbitrary system commands, potentially compromising the device. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with high impact on confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no patch or remediation has been published to date.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected devices, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability with high severity as indicated by the CVSS score of 9.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider isolating affected devices from untrusted networks and monitor for suspicious activity as temporary risk reduction measures.