Guardian language‑system transfers the id GET parameter directly into a PHP exec() call in speechmac.php without any sanitization, creating a classic command‑injection flaw (CWE‑78). An unauthenticated attacker can inject shell metacharacters into the id value and cause arbitrary operating‑system commands to run on the web server. This flaw grants full remote code execution on the underlying system and could lead to compromise of the entire server and the data it hosts.

The vulnerable component is the Guardian language‑system application, in particular the speechmac.php script located under the jobs directory. Identified by the CNA as guardian:language‑system, the product appears to expose this script via an HTTP GET interface without enforcing authentication. No specific version or release impact information is documented in the CNA data, implying that all current releases that include speechmac.php and lack input filtering are potentially affected.

With a CVSS score of 9.3 the flaw is in the critical severity range. The EPSS score of less than 1% suggests a low likelihood of active exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Because no authentication is required and the attack vector is over an HTTP request to speechmac.php containing a crafted id parameter, the condition for exploitation is trivial for an unauthenticated attacker with network access to the web server.