Profelis Information and Consulting Trade and Industry Limited Company SambaBox contains an Improper Control of Generation of Code flaw that permits OS Command Injection. If successfully exploited, an attacker can execute arbitrary commands with the privileges of the SambaBox service, potentially compromising confidentiality, integrity, and availability of the host. The likely attack vector is remote via SambaBox’s exposed interface, although the exact path is not detailed in the description.

All SambaBox installations from version 5.1 up to but not including 5.3 are impacted. The affected product is Profelis Information and Consulting Trade and Industry Limited Company SambaBox.

The CVSS score of 7.2 indicates a high severity risk, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the SambaBox component to craft a malicious payload; once they do, they can inject OS commands through the vulnerable interface. Because the flaw is present in multiple released versions, the risk persists until the affected software is updated.