WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. The flaw resides in the handling of the arpstrs parameter, where a user-supplied string is passed to a system call without validation. This allows an attacker to run arbitrary code in the context of the service account. Because no authentication is required, a node on the same network can directly exploit the service from its IP range. The weakness corresponds to CWE‑88.

The affected product is WatchYourLAN by WatchYourLAN. The reported vulnerability applies to all installations of the WatchYourLAN service; the CNA did not list specific version restrictions.

The CVSS base score of 8.8 signals high severity, while the EPSS score below 1% indicates low exploitation probability at the time of analysis. The vulnerability is not on the KEV list yet its unauthenticated remote code execution capability presents a serious risk for hosts on the same LAN. Attackers can trigger the flaw by sending crafted HTTP requests that include a malicious arpstrs argument while connected to the affected network, exploiting the lack of input validation and the open access control.