The Atlona AT‑OME‑MS42 Matrix Switcher firmware 1.1.2 contains a flaw in the /cgi‑bin/time.cgi script that accepts a serverName parameter in a POST request. When an authenticated user sends this payload, the script executes the value as an operating‑system command with root privileges, granting the attacker the ability to run arbitrary commands on the device. This vulnerability represents a classic command injection problem and is further compounded by parameter injection (CWE‑77).

The flaw affects Atlona AT‑OME‑MS42 Matrix Switcher devices running firmware version 1.1.2. No other firmware versions are mentioned, and no additional vendors or products are listed.

The vulnerability allows logged‑in administrators to elevate privileges and run arbitrary commands with root access. Although the EPSS score is below 1 %, indicating a low probability of exploitation, the CVSS score of 6.3 reflects moderate severity. The flaw is not currently listed in the CISA KEV catalog. Because the attack requires valid credentials, an adversary must first obtain or compromise credentials before the vulnerability can be exploited. Once authenticated, the impact is severe: full control of the switcher, potential network disruption, and data compromise.