Authenticated RCE via crontab command injection in BrainyCP 1.0

Successful exploitation allows remote execution of arbitrary commands on the BrainyCP host in the context used to apply/execute cron jobs, enabling full compromise actions such as spawning reverse shells and executing attacker-chosen payloads.

Restrict access to the BrainyCP administrative/crontab configuration functionality to only trusted users and networks; monitor/audit cron configuration changes and alert on suspicious entries (e.g., reverse shell patterns) and unexpected command execution originating from cron; apply compensating controls to prevent unsafe command execution paths in the crontab interface (e.g., hardening/validation around cron entry creation).

Upgrade BrainyCP to a vendor-patched release that fixes command injection in the crontab configuration interface. Ensure the crontab configuration feature performs strict input validation/allowlisting for cron syntax and does not pass user-controlled content to shell execution contexts.