Command injection exists in Raynet RVIA version 12.6 Update 8 and earlier, enabling an attacker to execute arbitrary code when a specially crafted path is used in the Java search operation. The unsanitized path feeds into the system’s find command, allowing the attacker to inject arbitrary shell commands. The flaw provides full control over the affected machine once exploited.

Raynet RVIA (Remote Virtual Interface Agent) is affected. Versions 12.6 Update 8 and all prior releases are vulnerable; no newer versions have been reported as impacted.

The vulnerability carries a CVSS score of 7.8, indicating high severity. No EPSS information is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring access to the component that performs the Java search; exact exploitation requires the attacker to supply a crafted path, but remote access would suffice. The potential impact is significant, as arbitrary code execution on the host can lead to full system compromise.