NSClient++ version 0.5.2.35 contains a feature that allows authenticated administrators to inject arbitrary scripts through the ExternalScripts library. An attacker who can submit commands to the /settings/query.json endpoint can cause those commands to be executed with SYSTEM privileges when the script is later triggered via /query/{name}. This flaw is a CWE-306 (Missing Authentication for Privileged Function) and CWE-94 (Code Injection) vulnerability that enables a malicious actor to take full control of the host with the highest local privilege level.

The vulnerability is present in NSClient++ 0.5.2.35 when the web interface on the default HTTPS port 8443 and the ExternalScripts module are enabled. Only this specific version is known to be affected; later releases are not listed as vulnerable.

The CVSS score of 7.5 reflects a high severity due to the potential for full system compromise. An EPSS score of 73% indicates that the exploit is likely to be used. The flaw is not listed in the CISA KEV catalog, but it can be exploited over the network by anyone who can authenticate using an administrator account. The attack vector is remote, relying on valid credentials and the use of the web API; it requires web access to port 8443 and the ExternalScripts functionality, with no additional preconditions beyond basic authenticated access.