openDCIM version 23.04 contains an OS command injection flaw in report_network_map.php where the application retrieves the 'dot' configuration from the database and passes it directly to PHP's exec() call without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary shell commands can be executed in the context of the web server process, giving full remote code execution and control over the system.

The affected product is openDCIM version 23.04, as indicated by the commit 4467e9c4. Only installations running this or earlier patched builds are susceptible. The vulnerability is not tied to any other version or vendor as per the CNA data, so the risk is confined to this specific component.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS rate of 31% indicates a high probability of exploitation in the wild. The likely attack vector is remote, through the web application or database interface that allows modification of the fac_Config.dot field; based on the description it is inferred that an attacker must gain write access to the database configuration to exploit the vulnerability. The vulnerability is currently not listed in the CISA KEV catalog, but the high severity and exploit probability warrant urgent remediation.