The Vulnerability allows an authenticated console administrator to inject and execute arbitrary OS commands on client machines through the Security Toolbox. By exploiting this bug, a threat actor can gain control over the victim systems, compromising confidentiality, integrity, and potentially availability. The weakness is an OS command injection flaw (CWE-78) with a CVSS score of 8.5.

Qingteng Host Adaptive Security Platform – Security Toolbox component of Host Monitoring, version V3.0. All Security Toolbox builds released before 20260929 are affected.

The flaw requires authentication to the console and can be triggered by an admin to run commands on attached clients. Because the EPSS score is not available, the exact exploitation frequency is unknown, but the high CVSS indicates a severe risk. The vulnerability is not listed in the CISA KEV catalog, though the potential impact warrants immediate attention. An attacker with console privileges could exploit it without additional conditions, making the attack vector straightforward for privileged users.