The flaw occurs in the /opennds_preauth/ endpoint where the fas query parameter is passed unsanitized to a shell script. This allows an attacker to inject arbitrary shell commands, potentially compromising the device's operating system. The weakness is a classic OS command injection (CWE-78).

The affected product is openNDS openNDS software released prior to version 11.0.0. Devices running any of these earlier releases of openNDS are susceptible to the flaw.

The CVSS score of 8.3 places this vulnerability in the high severity range, indicating that exploitation could threaten the system. Since the flaw is unauthenticated and exposed over a network endpoint, an attacker can trigger it from any nearby network or even over the internet if the gateway is publicly reachable. The EPSS score is 2%, indicating a low but non-zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the accessible attack surface and the potential impact make it a high‑risk issue.