The vulnerability allows an unauthenticated attacker to inject operating‑system commands through the rc/index.php endpoint. User supplied data is interpolated into a shell command string inside double quotes without escaping, and the command is subsequently executed by the cycle_execs.php script. This race condition enables the attacker to trigger arbitrary code execution on the host in less than one second. The weakness involved is command injection (CWE‑78), which compromises confidentiality, integrity, and availability of the affected system.

Affected systems are installations of MajorDoMo maintained by sergejey. No explicit version range is listed, so all releases that contain the vulnerable implementation of rc/index.php and cycle_execs.php are potentially affected.

The CVSS score of 9.2 indicates critical severity; the EPSS score of 25% reflects a moderate probability of exploitation in the near term, and the vulnerability is not yet catalogued in the CISA KEV list. The attack vector is network-based, requiring only HTTP access to the web interface; authentication is not required. Exploitation is performed by first invoking cycle_execs.php to start the command queue, then immediately sending the malicious input to rc/index.php so that the queued command is executed during the polling loop. The ability to run arbitrary commands in the context of the web server indicates a full remote code execution scenario.