OpenLiteSpeed and LSWS Enterprise contain an OS command injection vulnerability that allows an attacker with administrative credentials to execute arbitrary operating system commands. This flaw is a classic example of CWE-78 (OS Command Injection) and can lead to full compromise of the targeted server, affecting confidentiality, integrity, and availability of all services hosted on the affected machine.

The affected vendors and products are LiteSpeed Technologies: LSWS Enterprise and LiteSpeed Technologies: OpenLiteSpeed. No specific affected version ranges were provided in the CNA information, so all installations of these products are potentially vulnerable until a patch is applied.

The CVSS v3.1 score of 8.6 classifies the vulnerability as ‘High’ severity, indicating the potential for significant impact if exploited. The EPSS score of less than 1% suggests low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. However, the likely attack vector requires administrative access, implying that it is exploitable once an attacker or compromised admin account gains entry. Given the severity, systems should treat this as a priority risk.