A command injection flaw exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 firmware versions up to 7.7. The vulnerability allows an authenticated user to supply an action=runcmd parameter that is executed with root privileges. This flaw enables arbitrary shell command execution, thereby compromising the entire device, allowing the attacker to exfiltrate data, modify configuration, disable services, or further pivot into the network. The weakness is a classic OS Command Injection (CWE‑78).

Panabit PAP‑XM320 devices running firmware version 7.7 and earlier are affected. Newer firmware releases beyond v7.7 are not known to be impacted.

The exploit requires valid user credentials, so an attacker must first authenticate. Once authenticated, the command injection can be performed remotely if the device is reachable over the network, making the attack vector network‑based. Although EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the root‑level impact and straightforward exploitation path imply a high risk scenario. No public patch or workaround is currently provided, meaning the only defense is to migrate to a fixed firmware version or manually block the vulnerable endpoint.