CVE-2021-29003: Genexis PLATINUM 4410 router OS command injection via sys_config_valid.xgi

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS score of 9.8 and public exploit code on an internet-facing edge device.

What it is

Genexis PLATINUM 4410 devices running firmware 2.1 P4410-V2-1.28 pass user input to a shell without sanitization in sys_config_valid.xgi, allowing OS command injection. A remote unauthenticated attacker can execute arbitrary commands on the device, which sits at the network edge and is therefore broadly reachable.

Impact

An attacker gains arbitrary command execution as the web service user, enabling full device compromise, credential theft, traffic interception and use of the router as a pivot into the internal network.

Attack surface

Reachable over the network via HTTP requests to sys_config_valid.xgi with shell metacharacters in the exeshell parameter, as shown by the telnetd injection URI. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.45417 (98.7th percentile) and public references include an exploit write-up and a Packet Storm advisory, indicating working exploit code is publicly available.

What to do

• Apply the vendor firmware update for PLATINUM 4410 if Genexis has released one; the record does not name a fixed version, so confirm with the vendor.
• If no patch exists, restrict management/HTTP access to a trusted management VLAN or disable remote WAN administration.
• Replace or isolate end-of-life devices that cannot be patched.
• Block inbound access to the device web interface at the network perimeter and monitor for telnetd or shell-related requests.
• Change default credentials and audit the device for unauthorized configuration changes.

Detection

• Inspect HTTP request logs and IDS/IPS signatures for sys_config_valid.xgi requests containing shell metacharacters such as backticks, semicolons or pipes.
• Alert on unexpected telnetd or shell process launches on the device or on outbound connections from the router to unusual hosts.
• Monitor for new listening services on the device, particularly telnet on port 23.
• Review device configuration and firmware integrity for signs of tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.