The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script. An authenticated attacker can inject data that causes the script to execute arbitrary OS-level commands. This flaw is a classic operating system command injection (CWE-78), allowing the attacker to potentially compromise the host system, exfiltrate data, modify system files, or disrupt services. The impact includes loss of integrity and confidentiality and could enable lateral movement across the network if the KVM is exposed.

Affecting Angeet ES3 KVM devices. No specific affected versions are listed in the CNA data; therefore the scope of versions susceptible to the flaw is currently unknown.

The CVSS base score of 8.5 classifies this vulnerability as High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires authentication to the KVM; the exact network or local context is not specified, so it is inferred that the attacker must have valid credentials or access to the device to trigger the flaw. Given the high severity and the need for authenticated access, the risk is significant for environments that expose KVM management interfaces to untrusted users or networks.