The vulnerability is an OS Command Injection (CWE‑78) that allows an authenticated remote attacker to inject and execute arbitrary operating‑system commands on the WellChoose Single Sign‑On Portal System. This flaw can lead to complete compromise of the server, allowing the attacker to read, modify, delete data or pivot to other systems. The impact is broad, affecting confidentiality, integrity and availability of all data processed by the portal.

WellChoose Single Sign‑On Portal System is affected. The CVE payload does not specify affected versions, so the affected version range is unknown. The vendor recommends updating to IFTOP_P4_181 or later to mitigate the issue.

The CVSS score of 8.7 indicates a high severity flaw. The EPSS score is below 1%, suggesting a low likelihood of active exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw requires authentication, so the attacker must first gain legitimate access to the portal. Once authenticated, the attacker can inject commands with full privileges of the portal service, making this a severe remote code execution risk.