The vulnerability arises from insufficient validation of API request parameters in N2W versions prior to 4.3.2 in the 4.3 line and before 4.4.1 in the 4.4 line. This flaw allows an attacker to manipulate the parameters sent to the API to execute arbitrary code on the server. The impact is a remote code execution, which in effect could give the attacker full control over the affected system. The extent of control is inferred; the description states that code can be executed, and such execution typically enables system-wide compromise.

N2W is the affected product. Versions earlier than 4.3.2 in the 4.3 series and earlier than 4.4.1 in the 4.4 series are vulnerable. No other product or vendor details are provided beyond the product name. Organizations using these or older releases must evaluate whether they are exposed.

The severity is high, with a CVSS score of 9.8. The EPSS score is below 1%, suggesting few observed exploits in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, inferred from the fact that the flaw is exercised through API requests. An attacker needs the ability to send crafted API requests over the network to the exposed endpoints; no additional privileges are required. Because the flaw permits arbitrary code execution, the risk remains substantial despite the low EPSS.