CVE-2021-46704 — AI Deep Analysis Summary

🚨 **Essence**: GenieACS suffers from **Unauthenticated OS Command Injection**.…

🛡️ **Root Cause**: **Insufficient Input Validation** combined with a **Missing Authorization Check**.…

📦 **Affected**: **GenieACS** versions **< 1.2.8** (specifically >= 1.2.0). 🌐 **Component**: The UI interface API endpoint handling the `ping` host argument.

💀 **Attacker Capabilities**: Full **OS Command Execution** on the host server.…

⚡ **Threshold**: **LOW**. 🚫 **Auth**: **Unauthenticated**. No login or API key is required to trigger the vulnerability via the `ping` parameter. This makes it extremely dangerous.

🔓 **Public Exp**: **YES**. Multiple PoCs are available on GitHub (e.g., `MithatGuner/CVE-2021-46704-POC`) and Nuclei templates exist for automated scanning. Wild exploitation is highly probable.

🔍 **Self-Check**: Use **Nuclei** with the CVE-2021-46704 template.…

✅ **Official Fix**: **YES**. Upgrade GenieACS to version **1.2.8** or higher. 📝 **Commit**: Fixed in commit `7f295beeecc1c1f14308a93c82413bb334045af6`.

🚧 **Workaround**: If patching is impossible, **block external access** to the GenieACS UI/API port.…

🔥 **Urgency**: **CRITICAL**. 🚨 Since it is **unauthenticated** and allows **RCE**, it is a high-priority target for automated bots. Immediate patching or network isolation is required.