CVE-2021-46704: Genieacs

Critical severity, CVSS 9.8. EPSS: 21.9% chance of exploitation in the next 30 days.

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

Affected products

• Genieacs Genieacs: from 1.2.0, before 1.2.8 (fixed in 1.2.8)

Published 2022-03-06. Last modified 2026-06-17.