The developers should immediately refactor the system.py module to avoid shell=True and utilize Python’s subprocess API with argument lists. Additionally, the tool must implement a "revert-to-secure" routine to protect the user's hardware from exposure during and after the audit process.
While the script is running, the user's computer becomes discoverable and will accept pairing requests from any nearby device without authentication or encryption. This essentially turns the attacker's machine into a target for the very vulnerability they are attempting to audit.
The developers should immediately refactor the system.py module to avoid shell=True and utilize Python’s subprocess API with argument lists. Additionally, the tool must implement a "revert-to-secure" routine to protect the user's hardware from exposure during and after the audit process.
While the script is running, the user's computer becomes discoverable and will accept pairing requests from any nearby device without authentication or encryption. This essentially turns the attacker's machine into a target for the very vulnerability they are attempting to audit.