This vulnerability resides in the Cloud Task Scheduler component of HummerRisk; the regionId parameter in ResourceCreateService.java allows an attacker to inject and execute arbitrary system commands. The flaw is linked to CWE-74 and CWE-77, indicating that user‑supplied input is neither properly validated nor safely incorporated into a command execution. The base score of 5.3 denotes moderate severity, while an EPSS score of 19% indicates that active exploitation attempts are reasonably likely. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the task‑scheduler endpoint and the ability to supply crafted regionId parameters. Based on the description, the likely attack vector is remote over the network, inferred from the statement that the attack may be launched remotely, although the exact endpoint is not explicitly detailed.

The affected application is HummerRisk, versions up to and including 1.5.0. The flaw exists in the Cloud Task Scheduler module, so any deployment running these vulnerable releases may be impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of 19% suggests that active exploitation attempts are moderately likely. The vulnerability requires only remote access to the Cloud Task Scheduler API and manipulation of the regionId parameter, which, if not input‑validated, can result in arbitrary system command execution on the host. Because the flaw is not listed in the CISA KEV catalog, it has not yet been catalogued as a known exploited vulnerability, but the publicly disclosed exploit demonstrates the feasibility of attack. Remote attackers with permission to access the endpoint—whether via open port, exposed API, or misconfigured network—can exploit this weakness. Therefore, the overall risk is moderate to high in environments where the API is exposed to untrusted sources.