The vulnerability in VA MAX 8.3.4 allows an authenticated attacker to execute arbitrary shell commands by injecting metacharacters into the mtu_eth0 parameter on the changeip.php page. This leads to code execution as the apache user, exposing the system to full compromise. The weakness is classified as CWE‑22 and carries a CVSS score of 8.7.

VA MAX 8.3.4 exposes the vulnerable changeip.php endpoint. The affected product is VA MAX, version 8.3.4. No additional product or version information is disclosed.

The flaw is high risk with a CVSS score of 8.7 and is not listed in the CISA KEV catalog. EPSS data is unavailable, so the likelihood of exploitation is uncertain, but the remote nature and requirement for authenticated access make it a serious threat. The likely attack vector involves an attacker logging into the system, sending a crafted POST request to changeip.php, and injecting shell commands into the mtu_eth0 field to be executed by the web server process.