By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025.

The original advisory contains two example working proofs-of-concept exploits (which disclose the running user and the local /etc/passwd file to the remote requestor).

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

HexStrike AI MCP Server Command Injection


Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.

A proof-of-concept has been published at the referenced UniPwn Github repo.

Unitree Multiple Robotic Products Command Injection


By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password would no longer be the correct password.

Any discovery service that implements the eSCL specification can be used to exploit this vulnerability. One such implementation is the runZero Explorer, described at https://help.runzero.com/docs/installing-an-explorer/.

Any discovery service that implements the eSCL specification can be used to exploit this vulnerability. One such implementation is the runZero Explorer, described at  https://help.runzero.com/docs/installing-an-explorer/ .

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.

Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password (as described in the related vulnerability, CVE-2025-51978) would no longer be the correct password.

CISA ADP Vulnrichment


By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.

CWE-1188 Insecure Default Initialization of Resource

Abilis CPX Fallback Shell Connection Relay


NSA Ghidra Auto-Analysis Annotation Command Execution

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.