The vulnerability is a command injection flaw in the CommandHelper.executeCommands method of Oinone Pamirs 7.0.0. The method launches a shell process and writes attacker-controlled command strings directly to the process standard input without any validation. Executing arbitrary OS commands can compromise the confidentiality, integrity, and availability of the affected system. This is a classic example of the Command Injection weakness, identified as CWE-77.

Affected deployments include the Oinone Pamirs application version 7.0.0. No other vendor or product variants are listed, and the CNA has not provided additional affected versions. Administrators should confirm whether they are running this exact version and review any sub‑components that invoke the vulnerable executeCommands method.

The risk level is high because the bug allows unchecked command execution. The CVSS score for this vulnerability is 7.3, classifying it as high severity. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the absence of input sanitization suggests that exploitation is straightforward for anyone able to supply input to executeCommands. The most likely attack vector is through any unprotected functionality that forwards user data to this method, potentially allowing remote attackers if the interface is exposed. Due to the severe impact, immediate attention should be taken.