Command injection in Raynet rvia 12.6.4392.49-amd64.deb allows an attacker to execute arbitrary system commands through the getconfig endpoint, the upload functionality via a URL argument, and the oracle command using the -o flag. The flaw originates from argument injection in an internally constructed find command query. Because the application builds a search pattern to locate a Java executable without properly terminating or sanitizing user input, a crafted directory path can be used to trick rvia into invoking arbitrary Java code.

The affected product is Raynet’s rvia component, specifically version 12.6.4392.49 listed in the amd64 Debian package. No other vendors or product versions are identified as affected.

This is an arbitrary code execution flaw with a potential CVSS score not publicly available; the EPSS score is unknown and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a local attacker who can create a crafted directory structure or a remote attacker who can send malicious requests to getconfig, upload, or oracle endpoints could compromise the system. The likely attack vector involves local or privileged access to the machine or network exposure of the vulnerable endpoints.