Command Injection in Cobham SATCOM VSAT7090 Maritime Satellite Router

The Cobham SATCOM VSAT7090 Maritime Satellite Router, specifically firmware versions up to 20260704, is susceptible to a critical command injection vulnerability (CVE-2026-83772). The vulnerability resides in the c_set_reports_decode function within the mail-report.sh shell script. This component is responsible for parsing JSON data, but it fails to properly sanitize the sender and recipients arguments.

An unauthenticated remote attacker can exploit this flaw by sending a specially crafted JSON payload to the device. Because the application processes these arguments in a way that passes them to the underlying system shell, an attacker can inject arbitrary commands. Since the exploit is now public, this represents a significant risk for maritime organizations relying on these satellite communication terminals for external connectivity. The vendor has not provided a patch as of the disclosure date.

Impact

Successful exploitation allows for full remote code execution on the satellite router. Impact includes potential loss of device control, interception of maritime communications, and potential lateral movement into networks connected via the router. All sectors utilizing the VSAT7090 for maritime operations are at risk.

Recommendation

Prioritized, concrete actions for network and security teams:

• Immediately isolate affected Cobham VSAT7090 devices from the public internet if remote management is not required.
• Implement strict ingress filtering to limit access to the web interface or management API of the VSAT7090 to known, trusted management IP addresses only.
• Monitor web traffic directed to the router for JSON payloads containing shell metacharacters such as semicolon, pipe, or backtick in the sender or recipient fields.
• Contact Cobham support to inquire about firmware updates, as no official patch has been released for CVE-2026-83772.