CVE-2014-9727

This exploit leverages an unauthenticated remote command execution vulnerability in Fritz!Box routers by injecting shell commands via the 'var:lang' parameter in a crafted URL. The PoC demonstrates reading the VoIP configuration file, confirming arbitrary command execution.

This Metasploit module exploits an unauthenticated OS command injection vulnerability in various Fritz!Box devices via the `/cgi-bin/webcm` endpoint. It uses the `var:lang` parameter to inject commands and achieve remote code execution.