CVE-2023-26921

Deeper analysis

CVE-2023-26921 is an OS command injection vulnerability (CWE-78) affecting the Quectel AG550QCN cellular module. The flaw resides in the ql_atfwd component and permits unauthenticated attackers to supply crafted input that results in arbitrary operating-system command execution. It received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network reachability to the module can invoke ql_atfwd with malicious parameters to execute commands under the privileges of the affected process. Successful exploitation yields full control over the module, including the ability to read or modify data, alter configuration, or pivot to connected systems.

Public references consist of a GitHub repository containing a proof-of-concept description; no vendor advisory, patch information, or mitigation guidance is provided in the available sources. The associated EPSS score has remained low and essentially flat (current 0.0643, peak 0.0647), indicating limited observed exploitation interest since disclosure.