The vulnerability is a stack-based buffer overflow in the Shell configuration field of ZOC Terminal’s Program Settings. When a user supplies an excessively long string and subsequently launches the Command Shell feature, the application attempts to write the malformed input beyond its bounds, leading to a crash. The result is a denial of service that disrupts terminal sessions but does not provide remote code execution or privilege escalation. Impact is limited to the local machine and the user running the application.

Emtec’s ZOC Terminal version 7.23.4 is affected. Other versions are not listed as vulnerable in the available data.

With a CVSS score of 6.9, the vulnerability is considered moderate. No EPSS rating is available and it is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity. The attack vector is local; an attacker must have access to the machine and the ability to paste a crafted payload into the Shell field. The exploit does not grant code execution or escalation, but it can interrupt legitimate use by crashing the application.