EIP-2026-101396

This exploit demonstrates an unauthenticated semi-blind command injection vulnerability in Osprey Pump Controller 1.0.1 via the 'pseudonym' HTTP POST parameter. The PoC uses a simple curl command to inject and execute arbitrary shell commands (e.g., 'pwd').