All versions of InSAT MasterSCADA BUK-TS allow OS command injection through a field in the MMadmServ web interface. An attacker who can reach this vulnerable endpoint can execute arbitrary operating‑system commands, effectively achieving remote code execution. The weakness matches CWE‑78, which concerns OS command injection and allows malicious input to manipulate command line arguments.

The affected product is InSAT MasterSCADA BUK‑TS. According to the CNA data, every released version of this product is susceptible; no specific version numbers are provided, so the entire product line is impacted.

The CVSS score of 9.3 indicates a high severity. EPSS is reported as 1%, implying a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the potential for remote code execution through the web interface makes it dangerous. The likely attack vector is remote, through network access to the MMadmServ endpoint, and attackers would need to provide a crafted input to trigger the injection. While the description does not detail authentication requirements, it is inferred that access to the vulnerable web interface is required, making the exploitation feasible for network or authenticated attackers.