OP5 Monitor versions up to 7.1.9 contain an authenticated command injection flaw in the command_test.php endpoint. The vulnerability is triggered by supplying arbitrary input to the cmd_str parameter while using the Test this command feature. An attacker who has valid login credentials and access to the web interface can run any shell command as the web application user, which can lead to remote code execution with the privileges of that user.

The affected product is OP5 Monitor from the ITRS Group, specifically versions 7.1.9 and all earlier releases. The issue was fixed starting with version 7.2.0.

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score of 53% indicates a significant likelihood that exploitation attempts could occur in the near term. The vulnerability is not listed in CISA’s KEV catalog, but it requires authentication to the web interface and legitimate access to the command_test feature, which limits the attack scope to environments where an attacker can obtain credentials or compromise a user who has those permissions. Overall, the risk is elevated due to the high exploitation probability and the potential for arbitrary code execution on the monitored systems.