An OS Command Injection flaw in IEI Integration Corp's iVEC TANK-XM811 allows a privileged remote attacker to run arbitrary operating system commands on the device, compromising confidentiality, integrity, and availability of the affected system. This weakness corresponds to CWE-78 and grants the attacker full control over the host operating system when exploited. The vulnerability can be used to steal configuration data, alter device behavior, or pivot within the network.

Affects IEI Integration Corp’s iVEC TANK-XM811 product. Specific firmware or build versions are not documented in the public advisory, so the impact applies to any deployed instance of the listed hardware that has not applied a vendor update.

The reported CVSS score of 8.6 indicates a high severity risk. EPSS data is not available, so the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not have known active exploitation. However, the remote nature of the attack vector and the privileged access required imply that once an attacker gains network reach to the device, they can moderately easily exploit the flaw to execute arbitrary commands.