Uncontrolled Search Path Element in Owl opds 2.2.0.4 enables an attacker to alter or inject entries into the system search path by sending a crafted network request. This vulnerability, identified as CWE‑427, allows the attacker to influence where the operating system resolves executable names, potentially leading to execution of malicious binaries or scripts with elevated privileges. The impact is a loss of confidentiality, integrity and availability through arbitrary code execution on the affected system.

The vulnerability affects Owl Cyberdefense’s opds product line, specifically the opds‑1000 and opds‑100 hardware variants and the opds‑talon firmware version 2.2.0.4. Systems running these versions without the vendor‑released fix are susceptible to exploitation.

The CVSS score of 8.4 classifies this flaw as high severity, and the EPSS score of less than 1% indicates a low current exploitation probability. The attack vector is inferred to be network-based, as the flaw is triggered by a crafted network request to the configuration interface. The vulnerability is not listed in the CISA KEV catalog, suggesting there are no known widespread, targeted exploits at present. Nevertheless, the potential for arbitrary code execution warrants immediate attention.