CVE-2026-83524

CVE-2026-83524 is a command injection flaw (CWE-74/CWE-77) in the exec function of /xgatev1/system/datetime.php, part of the System Clock component, in RedPort Optimizer wXa-203, wXa-213 and wXa-223 firmware up to and including build 20260704. A remote attacker with low-privileged (authenticated) access to the device's web interface can manipulate input passed to this handler to inject and run operating-system commands. Successful exploitation yields command execution on the appliance with high impact on confidentiality, integrity and availability, reflected in the CVSS 4.0 score of 8.6 (high). Affected users are operators of these RedPort satellite-communication Optimizer appliances, which are typically deployed on vessels and at remote sites; all units running firmware up to 20260704 are vulnerable. The exploit has been publicly disclosed and may be used, the vendor was contacted early but did not respond, no fix is announced, and the flaw is not yet in CISA KEV with an EPSS 30-day exploitation probability of about 1.7%.

What to do: Because the vendor did not respond and no fixed firmware is announced, treat every build up to and including 20260704 as vulnerable and reduce exposure: restrict access to the device's web/admin interface (including the /xgatev1/ endpoints) to trusted networks or VPN and avoid exposing it directly to the internet. Monitor HTTP and device logs for unusual requests to /xgatev1/system/datetime.php, and watch for an updated firmware release from RedPort.