However, watchTowr researchers found that a redirect script called uiEnvSetup.php expects the HTTP_X_PAN_AUTHCHECK value to be set to off, and if this is provided in the request, the server will just accept it.

“We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!,” the researchers wrote in their report. “At this point, why is anyone surprised?”

The second bug is also trivial, being a command injection flaw that allows shell commands to be passed as a username to a function called AuditLog.write(), which then passes the injected command to pexecute(). But the passing of the payload to this logging function is actually the result of a different functionality that is itself quite scary, according to the researchers.