This vulnerability allows unauthenticated attackers to execute arbitrary system commands on the NetGain EM Plus server by sending a POST request to the /script_test.jsp endpoint with malicious content in the 'content' parameter. The flaw arises from improper validation of user-supplied data, classified as a CWE‑94 code injection. Successful exploitation grants full control over the underlying operating system, potentially compromising confidentiality, integrity, and availability of the system.

The affected vendor is NetGain Systems, product NetGain EM Plus. Information from the CNA indicates only the product name; no specific version numbers are listed in the supplied CNA data. Therefore, any deployment of NetGain EM Plus is potentially vulnerable until further version information is confirmed.

The CVSS score of 9.3 characterizes this issue as Critical, indicating that an attacker can fully compromise the system without authentication or local access. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a POST request to script_test.jsp; there are no prerequisites beyond unauthenticated network access to the endpoint.