The vulnerability is an OS command injection flaw that originates from improper neutralization of special elements used in an operating system command. The weakness, identified as CWE-78, allows an attacker to inject arbitrary commands into an OS command string when user input is concatenated without adequate validation or escaping. Successful exploitation would give the attacker control over the underlying operating system, resulting in potential data compromise, persistence, and lateral movement within the environment.

The affected vendor is TR7 Cyber Defense Inc. and the product is TR7 ASP. Vulnerable firmware versions include any release from 1.0.40.236 up to, but not including, 1.0.1554.2331, and from 1.6.42.239 up to, but not including, 1.6.1554.2331. The vulnerability is present on both virtual and physical appliance deployments of TR7 ASP.

The CVSS score of 9.8 indicates critical severity and the EPSS score of 0.01699 (≈1.7%) suggests a low but non‑negligible exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the severity and nature of the flaw mean that attackers can achieve remote code execution if they can supply malicious input. The likely attack vector is through unauthenticated or authenticated web or API input that is passed directly to a shell command, with no additional prerequisites beyond the ability to submit that input.