# Pre-auth input to shell in appliances

Unauthenticated request, log, or AT-command data reaching system/popen/eval before any auth check

_Area: Network devices and IoT. Seen in 6 disclosed reports; one confirmed bounty: $2,000; latest 2026-09-30. Updated 2026-10-23._

## How it works
An appliance trusts that data arriving before authentication is inert. It is not. A request parameter, a log line, or a serial AT command is copied into a string that a privileged component later hands to a shell (`system`, `popen`, backticks) or to `eval`. The assumption that breaks is "this input is only data": once it is concatenated into a command string, shell metacharacters in it become syntax. The sink often runs as root, and the input path is reachable with no credentials [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md)[E4](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md)[E6](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md).

## Where it shows up
- `system()`/`popen()` sites where a value is `sprintf`'d as `%s` rather than converted to an integer [E1](https://bugbountylibrary.com/r/blog%3Anns-ee-blog-2021-04-03-modem-rce-html.md)[E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware.md)[E5](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection.md)
- Log-writing endpoints (login fields, User-Agent) whose lines a privileged parser script later shells out on [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md)[E6](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md)[E7](https://bugbountylibrary.com/r/blog%3Asygnia-co-threat-reports-and-advisories-actively-exploited-netscaler-vulnerabilities.md)
- `eval()`/`b64decode` on a GET parameter guarded only by a substring check [E4](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md)
- Fixed blacklist arrays used as the only sanitizer [E5](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection.md)
- Hidden console commands not listed in HELP output [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware.md)

## How to review
Trace every pre-auth entry point (web route, serial parser, log field) to its sinks. The invariant: untrusted bytes must never be concatenated into a shell or eval string. Safe forms are argument-vector execution, strict allowlists, or integer conversion. For each sink ask: is the value formatted as `%s`? Is the guard a blacklist? Does it cover newline, tab, `$IFS`, backticks? Does the auth gate actually cover this view, or only adjacent middleware [E4](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md)? For log processors, check whether extracted fields are re-interpolated into backticks [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md).

## Variants seen
- AT-command parameter into `system()` in a modem daemon [E1](https://bugbountylibrary.com/r/blog%3Anns-ee-blog-2021-04-03-modem-rce-html.md)
- Log poisoning into a Perl maintenance script's backtick `find` [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md)[E6](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md)[E7](https://bugbountylibrary.com/r/blog%3Asygnia-co-threat-reports-and-advisories-actively-exploited-netscaler-vulnerabilities.md)
- CGI query/POST param into `system_ctrl()`/`system()` [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware.md)[E5](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection.md)
- `eval()` of base64 GET param in embedded Django [E4](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md)
- Console command handler into `popenCmd()` [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware.md)

## Why fixes fail
Blacklists miss single bytes: omitting `0x0A` re-enables injection [E5](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection.md). Vendor patches that swap a shell pipeline for a regex hint at the original flaw but may leave sibling scripts [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md).

## Impact and severity
Root RCE, often unauthenticated, on internet-facing appliances; observed in-the-wild exploitation dropping web shells across ~70,000 hosts [E4](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md)[E6](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md). Severity rises with pre-auth reachability and root context.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Anns-ee-blog-2021-04-03-modem-rce-html.md
- E2: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771.md
- E3: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware.md
- E4: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts.md
- E5: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection.md
- E6: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md
- E7: https://bugbountylibrary.com/r/blog%3Asygnia-co-threat-reports-and-advisories-actively-exploited-netscaler-vulnerabilities.md