dnsmgr version 2.15 and prior contain a flaw in the ping routine of the CheckUils.php script that allows a local attacker to run arbitrary commands. The vulnerability is rooted in unsafe handling of user supplied data in a system call, classifying it as a command injection weakness (CWE‑77). Successful exploitation gives the attacker the same privileges as the web application process, potentially compromising the host system entirely.

Any dnsmgr deployment using version 2.15 or earlier is affected. The CheckUils.php file must be accessible on the host; an attacker with local or privileged access can invoke the ping function and trigger the vulnerability.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests that, as of this assessment, the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; the attacker needs to reach the server hosting dnsmgr and be able to execute or alter the CheckUils.php script, such as through local file inclusion or by manipulating input to the ping function.