This vulnerability is an OS command injection that arises from improper neutralization of special elements. An attacker can supply crafted input that is passed to an operating system command without proper sanitization, enabling the execution of arbitrary commands with root privileges. The result is a complete compromise of the system, allowing the attacker to read, modify, or delete any data, install additional malware, or disrupt network services. The severity is high, as the flaw directly enables full system compromise.

Ericsson Packet Core Controller (PCC) versions earlier than 1.38 are impacted. No other products or versions are currently listed as affected.

The CVSS score of 8.5 classifies this flaw as high severity. Because the EPSS score is less than 1%, the exploitation probability is very low, and the lack of a KEV listing suggests that no widespread exploitation has been documented as of now. The likely attack vector is remote, inferred from the fact that PCC components are exposed to network traffic; however, the description does not explicitly state the network reachability, so the assumption remains that an attacker with network access or local exposure could trigger the defect.