IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 contain a command injection flaw that allows a remote authenticated attacker to execute arbitrary shell commands. The weakness arises from improper validation of input that is passed directly to the operating system shell, making the application vulnerable to CWE‑78. Successful exploitation would grant the attacker full control over the underlying host, compromising confidentiality, integrity, and availability of the server and any data it services.

Systems running IBM Aspera Faspex version 5.0.0 up to and including 5.0.15.4 on Linux are impacted. The issue does not affect other vendors or product lines according to the CNA data. Administrators should review their deployments for these specific versions.

The CVSS severity score is 9.1, indicating a critical vulnerability. The EPSS score of 1% suggests a low but realistic probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires a remote authenticated session, implying that an attacker must first gain valid credentials to the Faspex service. Once authenticated, the attacker can inject malicious commands that the application will execute with the privileges of the Faspex process.