An authenticated attacker can exploit a flaw in Packetfence's WebGui interface configuration, enabling arbitrary command execution on the host. The vulnerability allows the attacker to run arbitrary code with the privileges of the web service, potentially compromising system integrity, confidentiality, and availability. No further details are provided, but the capability to execute code remotely places the system at high risk if accessed by malicious actors.

Packetfence version 13.2.0 is vulnerable. The flaw resides in the WebGui configuration setting and is specific to that release. No other versions or products are listed.

The CVE has no publicly available EPSS score and is not listed in the CISA KEV catalog. However, the nature of the vulnerability—remote code execution requiring authentication—implies a high impact should credentials be compromised. The attack vector is inferred to be through the web interface after an attacker gains authenticated access; once authenticated, the attacker can manipulate the vulnerable setting to run arbitrary commands. The lack of an EPSS score means no quantitative probability is available, but the required conditions (authenticated access) suggest that an internal attacker or a compromised account poses the greatest threat.