The generateSrpArray function contains an OS command injection flaw caused by improper neutralization of special elements. An attacker who can supply input to this function can execute arbitrary operating‑system commands, resulting in full compromise of the affected system.

Vendor products MB connect line:mbCONNECT24 and MB connect line:mymbCONNECT24 are affected. No specific version information is listed, so all current releases should be assumed vulnerable until a vendor update is issued.

The CVSS score of 7.2 indicates high severity, but the exploit probability (EPSS) is not available and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires the attacker to first obtain a capability to write arbitrary data to the user table; once that is achieved, the OS command injection can be triggered remotely over the network. Full credential compromise or data exfiltration is possible if the attacker can execute desired commands.