Comtrend AR-5310 firmware version R10.A2pG039u.d24k contains a restricted shell escape vulnerability that permits local users to insert the command substitution operator $( ) into arguments of allowed commands such as ping. This allows an attacker to execute arbitrary shell commands beyond the intended command list, effectively providing unrestricted shell access on the device. The weakness is identified as CWE-306: Authentication Bypass Through User-Controlled Key.

The affected product is the Comtrend AR-5310 router. The vulnerability applies specifically to firmware build GE31-412SSG-C01_R10.A2pG039u.d24k. No other versions or products are listed as affected.

The CVSS score is 8.6, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting low exploit probability in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; an individual with physical or console access to the router can exploit the vulnerability by crafting a command that incorporates $( ) into supported command arguments. No remote exploitation is documented in the provided data.