CVE-2026-84059: Command Injection in ICP DAS UA-2200

This vulnerability affects ICP DAS UA-2200 and UA-5200 devices up to the 20260704 version. It resides in the ArmAngstromInstructionSet function of the /CGI?RestApi=SetHostname interface. An attacker can remotely manipulate the ParameterArray argument to execute arbitrary commands on the device, leading to command injection. The vendor was contacted but did not provide any response or remediation. Exploit code is publicly available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, availability, and security requirements. No official fix or patch has been published as of the data provided.

Successful exploitation allows remote attackers to execute arbitrary commands on affected ICP DAS UA-2200 and UA-5200 devices, potentially compromising device integrity and control. The impact is rated medium severity with limited impact on confidentiality, integrity, and availability according to the CVSS 4.0 vector. No active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected devices and monitor for suspicious activity targeting the /CGI?RestApi=SetHostname endpoint. Avoid exposing these devices directly to untrusted networks until a vendor fix is released.