Command Injection Vulnerability in ICP DAS UA-2200 and UA-5200

CVE-2026-84059 is a critical command injection vulnerability affecting ICP DAS UA-2200 and UA-5200 series controllers running firmware versions up to 20260704. The vulnerability resides within the ArmAngstromInstructionSet function, which is triggered when processing input to the /CGI?RestApi=SetHostname endpoint. By manipulating the ParameterArray argument in a crafted HTTP request, an attacker can inject and execute arbitrary system commands on the underlying appliance. This flaw is remotely exploitable without authentication, and functional exploit code has been publicly released, increasing the risk of exploitation by opportunistic threat actors. Given the lack of a vendor response or patch availability, defenders must prioritize network-level segmentation to restrict access to the web interface of these devices.

Impact

Successful exploitation allows for full system compromise of the affected Industrial IoT (IIoT) controllers. This could lead to unauthorized control over connected industrial processes, exfiltration of sensitive configuration data, or the use of the devices as persistence points within the internal network. The scope affects all deployments of UA-2200 and UA-5200 series units that have not implemented strict ingress filtering to the management web interface.

Recommendation

1. Restrict network access to the management web interface of all ICP DAS UA-2200 and UA-5200 controllers to authorized administrative subnets only.
2. Deploy the provided Sigma rule at the network layer (WAF or IDS) to monitor for malicious HTTP POST requests containing command injection patterns targeting the /CGI?RestApi=SetHostname endpoint.
3. Monitor device logs for unexpected process execution or modifications to configuration files, as the vulnerability enables arbitrary command execution.
4. Segment these controllers into an isolated VLAN to limit lateral movement potential in the event of compromise.