Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to 4.3.3-R4, contain an undocumented, backdoor root shell. This shell is accessible via a specific url, to any authenticated user. The module uses this shell to execute arbitrary system commands as root.
cce7da9c26f8e8caf232905b3e36a9ab132e3adc8e18feeb48e4f97de90a8cef