CVE-2024-7580

CVE-2024-7580 is a critical OS command injection vulnerability affecting Alien Technology ALR-F800 devices running firmware up to version 19.10.24.00. This flaw allows unauthenticated remote attackers to execute arbitrary commands by manipulating the 'uploadedFile' argument in the /admin/system.html file. With a CVSS score of 9.8, the vulnerability poses a severe risk, enabling full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild or public exploit code (Metasploit, Nuclei, ExploitDB), the exploit details have been publicly disclosed, and there is significant community discussion, indicating potential for future exploitation.