Eclipse Equinox OSGi 3.7.2 and earlier allow attackers to execute arbitrary commands through the console interface. An unauthenticated attacker can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives, enabling remote code execution and the establishment of reverse shell connections.

The vulnerability affects the Eclipse Equinox OSGi platform, version 3.7.2 and earlier. Systems running these versions are vulnerable unless the console interface is disabled or upgraded.

The CVSS score of 9.3 indicates high severity, and the absence of an EPSS score or KEV listing does not diminish the risk of exploitation. Because the flaw permits unauthenticated command execution via a network-accessible console port, attackers can readily exploit it without any credentials. The high severity and ease of exploitation make this a critical threat for exposed Equinox OSGi environments.