Telqrrr

**Name of the Vulnerable Software and Affected Versions** webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 **Description** Remote os command injection is possible through the manipulation of the `case name` argument. This issue occurs within the `controller listen()` and `controller recover()` functions located in the `py/web.py` file. **Recommendations** As a temporary workaround, restrict access to the `controller listen()` and `controller recover()` functions in the `py/web.py` file. Avoid using the `case name` argument in the affected functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.