An OS command injection flaw was discovered in the qq function of the /cgi-bin/session_login.cgi script in SECCN Dingcheng G10 3.1.0.181203. By supplying a crafted User argument, an attacker can execute arbitrary operating‑system commands on the web server. The vulnerability is both a command injection (CWE‑77) and an operating‑system command injection (CWE‑78) issue, allowing an attacker to compromise confidentiality, integrity, and availability of the affected host.

This vulnerability affects SECCN Dingcheng’s G10 web server component, specifically version 3.1.0.181203. No other versions or products are listed, so the affected scope is limited to installations running that exact build of G10.

The flaw carries a CVSS base score of 9.3, indicating a high‑severity risk. While the EPSS score is below 1 %, indicating low probability of exploitation in the wild, the exploit has already been disclosed publicly and could be used remotely if the vulnerable script is reachable over the network. The attack vector is network‑based, requiring no authentication or local access, and it exploits unchecked user input that is directly passed to a system command.