EIP-2026-114784

This exploit targets FreeWnn 1.1.0's jserver component by sending a crafted JS_MKDIR command with a semicolon to inject arbitrary commands, achieving remote code execution. The PoC establishes a socket connection, authenticates, and exploits the unsanitized input vulnerability.