This vulnerability is an OS command injection flaw located in the ImportParamSet.sh script on Xovis AG APS devices. The script incorporates symlink targets from uploaded parameter archive files into shell commands without quoting or sanitization, allowing an attacker to inject arbitrary commands that are executed with root privileges via the APC_SendMsg IPC mechanism. The affected firmware versions are 2.10.1.1 and earlier for APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB and APS-B models, giving an attacker potential complete control over the device and the underlying operating system.

Devices running Xovis AG APS firmware versions 2.10.1.1 and earlier, including the APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB and APS-B series, are affected. The vulnerability resides in the system script ImportParamSet.sh, which is part of the device’s firmware. No specific vendor-provided fix is cited in the provided references.

Because the flaw allows an attacker to execute arbitrary commands as root, the potential impact is high, allowing full compromise of the device. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that public evidence of exploitation has not yet been reported. The likely attack vector is remote if an attacker can upload a crafted parameter archive through the device’s management interface; however, local exploitation is also possible if the attacker gains access to the file system. The absence of a patch in the data suggests that customers should verify whether an updated firmware version is available or apply mitigations before a vendor release. Given the root-level code execution, this flaw should be treated as critical until a remedy is provided.