An OS command injection flaw exists in TOA Corporation’s TRIFORA 3 series network cameras. The vulnerability allows an authenticated user with monitoring or higher privileges to inject and run arbitrary operating‑system commands, granting full control over the device’s firmware. This is classified as CWE‑78, indicating improper input validation in a command execution path.

The affected equipment is the TRIFORA 3 series network cameras made by TOA Corporation. No specific firmware versions are listed, so any camera that is running the vulnerable firmware should be considered at risk until an updated image is applied.

The CVSS score of 8.7 places the issue in the high‑risk category, and the EPSS score of less than 1% shows that exploitation probability is presently low. The vulnerability is not included in CISA KEV. An attacker must first authenticate to the camera’s administrative interface, then send crafted input to trigger the command injection. Successful exploitation results in arbitrary code execution on the device, potentially enabling lateral movement or data exfiltration.