This vulnerability is an OS command injection flaw caused by improper neutralization of special elements within the output redo/tuning functionality of Samsung Open Source QA‑Board. An unauthenticated attacker can supply crafted input that is injected into an operating‑system command line, allowing arbitrary command execution with the privileges of the QA‑Board process, potentially leading to full system compromise, data exfiltration, or denial of service.

The affected product is Samsung Open Source QA‑Board. No specific version ranges are provided in the advisory, so any release containing the unpatched output redo/tuning code may be vulnerable.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of 1% denotes a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote and unauthenticated, where the attacker sends crafted input to the vulnerable interface to trigger the injection, thereby gaining control of the host system.