HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')