The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action…

The GoAhead web server running on MeiG Smart FORGE_SLT711 devices contains a critical vulnerability that allows unauthenticated OS command injection. The vulnerability exists in firmware version MDM9607.LE.1.0-00110-STD.PROD-1 and can be exploited through the /action/SetRemoteAccessCfg endpoint. This flaw enables remote attackers to execute arbitrary operating system commands without authentication. The vulnerability affects IoT devices that may be deployed in various network environments. Proof-of-concept code has been published on GitHub, increasing the risk of exploitation.