The CVSS 9.8 rating for this command injection vulnerability in WGDashboard is technically accurate, but the 'authenticated attacker' qualifier obscures a deployment reality that makes this far more dangerous than the score suggests.
WGDashboard is a web-based management interface for WireGuard VPN servers. The application must run as root because it needs to manipulate network interfaces and routing tables — that's non-negotiable given WireGuard's design. What matters is what sits in front of that root-level command execution: typically a web UI exposed directly to the internet on ports 443 or 80, managed by small-scale operators who often use weak credentials or never change defaults.
The authenticated/unauthenticated distinction collapses in this context. If your dashboard is internet-facing with a guessable password — and evidence suggests this is common in the WGDashboard deployment base — the 'authentication' requirement becomes a speed bump rather than a gate. Attackers scanning for exposed WireGuard management interfaces will find these boxes, test common credentials, and land at root in a single step. You are not dealing with an attacker who already has valid credentials; you are dealing with an attacker who can obtain them trivially against this target class.
The blast radius extends beyond the host. Compromising a WGDashboard instance typically means compromising a VPN endpoint that other infrastructure trusts. The attacker gains access to peer lists, private keys, routing tables, and potentially all traffic flowing through those tunnels. WireGuard's cryptographic authentication — designed to protect traffic — now works in reverse: every peer connecting to a compromised endpoint trusts a box the attacker controls.
Before patching, verify your deployment model: Is the dashboard accessible from the internet? What credentials are in use? Is there any API endpoint or session mechanism that might have separate weaknesses? The patch should be scrutinized for whether it tightens authentication enforcement or merely sanitizes inputs — the latter leaves the structural risk intact. Given the root-level execution path and internet-facing deployment pattern common to this tool, treat this as a critical perimeter vulnerability regardless of the 'authenticated' label.