In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0‑rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands that are executed over SSH or locally on the agent host. If an attacker can modify that API response, they can insert shell metacharacters, causing the CLI to run arbitrary commands when it provisions or attaches an agent. This flaw is a classic command injection (CWE‑78) that permits remote code execution on the target agent.

The vulnerability affects all Eclipse ioFog iofogctl releases from 1.0.0 to 3.7.0 and 3.8.0‑rc.1 to 3.9.1. The affected component is the iofogctl command‑line tool used by operators to provision and manage agents.

The CVSS score of 5.5 reflects moderate severity and the EPSS score is not available, indicating limited publicly known exploit activity. The vulnerability is not listed in the CISA KEV catalog. An attacker who can influence the Controller API response—either by compromising the Controller itself or by injecting malicious data—can inject command sequences that will run under the authority of the agent user. This results in non‑privileged remote code execution on the agent host, with potential to compromise the host or pivot to other systems.