The vulnerability permits an attacker to inject and execute arbitrary operating‑system commands by supplying a crafted media definition to the Westermo WeOS 5.x firmware. This flaw can lead to complete compromise of the affected device, including data exfiltration, configuration tampering, or service disruption. The weakness is a classic OS command injection (CWE-78).

Westermo WeOS firmware version 5.24 and later (5.x series). The issue exists in all builds of the WeOS operating system released within that series starting from version 5.24.

The CVSS score of 7.6 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploit at this time. However, the attack path can be realized from an external network when an attacker is able to submit a media definition through the device’s exposed interface, making the risk moderate to high if the asset is reachable. The lack of an exploit in the wild may lower the immediate threat, but the potential for full system takeover warrants prompt remediation.