The vulnerability is a code injection flaw (CWE-94) that allows an attacker with administrative privileges on a Micro Research Ltd. MR‑GM5L‑S1 or MR‑GM5A‑L1 device to execute arbitrary commands. This flaw can lead to a complete compromise of the affected system, as any command can be run with the privileges of the service or configuration in which the injection is possible, threatening both integrity and availability.

Micro Research Ltd. products MR‑GM5L‑S1 and MR‑GM5A‑L1 are affected. No specific firmware or software version information is provided; administrators should assume that all current releases of these models may be vulnerable until a patch is released.

The CVSS score of 8.6 indicates high severity. EPSS shows an exploitation likelihood of less than 1%, indicating a low probability of automated attacks, but the impact would be severe if exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploits yet. Attack exploitation requires local administrative access, implying an insider or compromised account scenario; thus the risk is significant for organizations that provide or share administrative credentials.