SysAK contains an input validation flaw in the "aaa" function that allows attackers to inject and execute arbitrary shell commands, such as “cat /etc/passwd”. This command‑injection weakness (CWE‑94) can be used to read sensitive files, modify system configuration, or launch further exploitation, effectively compromising the confidentiality, integrity, and availability of the affected host.

All releases of SysAK up to and including version 2.0 are impacted. The product is named SysAK, and no specific vendor is listed. Administrators should verify that their installation is version 2.0 or earlier and consider it vulnerable.

The CVSS score of 9.8 denotes critical severity, while an EPSS score of less than 1% suggests that widespread exploitation is not yet common but still possible where the vulnerable interface is exposed. Based on the description, it is inferred that the attacker must be able to trigger the "aaa" function with crafted input, which could occur through a network‑exposed service or local usage. Successful exploitation would grant the attacker full control of the host without requiring elevated privileges, making this a high‑risk issue not yet listed in the CISA KEV catalog.