CVE-2019-17270: Yachtcontrol systemcall.php unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network RCE, public exploit code, and very high EPSS (99th percentile) make this an urgent risk despite not being in KEV.

What it is

Yachtcontrol through 2019-10-06 exposes a /pages/systemcall.php endpoint whose command parameter is passed directly to the operating system without sanitization. An unauthenticated remote user can execute arbitrary OS commands and receive the output, giving full control of the affected webserver.

Impact

An attacker gains remote code execution as the webserver process, allowing command execution, data theft, and further compromise of the host. Because the flaw is unauthenticated, no credentials are needed.

Attack surface

Reachable over the network via HTTP requests to /pages/systemcall.php with a crafted command parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description notes affected webservers are exposed via Dutch GPRS/4G mobile IP ranges with DHCP-assigned addresses.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit), and EPSS is 0.58879 (99th percentile), indicating high likelihood of exploitation. CISA KEV does not list this CVE.

What to do

• Apply the vendor fix or upgrade Yachtcontrol past the 2019-10-06 version if available; if no patch exists, isolate or decommission the affected webserver.
• Restrict network access to /pages/systemcall.php and the Yachtcontrol web interface using firewall rules or a reverse proxy with authentication.
• Disable or remove the systemcall.php page if it is not required for operations.
• Validate and sanitize all input to the command parameter, or replace direct OS command execution with a safe API.
• Monitor for and block outbound connections from the webserver host to unexpected destinations.

Detection

• Search web server logs for requests to /pages/systemcall.php with command parameters, especially containing shell metacharacters or common commands (id, whoami, curl, wget).
• Monitor process creation on the webserver host for unexpected child processes spawned by the web server user.
• Alert on outbound network connections from the Yachtcontrol host to unfamiliar IPs or ports.
• Use the public Exploit-DB/Packet Storm PoC signatures to create IDS/IPS rules for the specific request pattern.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.