The vulnerability in openDCIM’s report_network_map.php allows arbitrary shell command execution when the application passes the 'dot' configuration parameter directly to PHP's exec() without validation. This flaw is a classic OS command injection, enabling attackers who can change the fac_Config.dot value in the database to run arbitrary commands in the web server process. The impact is full remote code execution, giving an attacker control over the underlying system.

The affected product is openDCIM version 23.04, as indicated by the commit 4467e9c4. Only installations running this or earlier patched builds are susceptible. The vulnerability is not tied to any other version or vendor as per the CNA data, so the risk is confined to this specific component.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS rate of 31% indicates a high probability of exploitation in the wild. The likely attack vector is remote, through the web application or database interface that allows modification of the fac_Config.dot field; based on the description it is inferred that an attacker must gain write access to the database configuration to exploit the vulnerability. The vulnerability is currently not listed in the CISA KEV catalog, but the high severity and exploit probability warrant urgent remediation.