The vulnerability allows an attacker to inject arbitrary operating‑system commands into the command line that H3C ACG1000‑AK230 executes when the /webui/?aaa_portal_auth_local_submit endpoint processes the 'suffix' argument. The injection is possible because the input is not properly validated, resulting in a classic command‑injection weakness identified as CWE‑74 and CWE‑77. Successful exploitation lets the attacker execute arbitrary code with the privileges of the web service, potentially compromising the entire device.

Affected systems are H3C ACG1000‑AK230 routers and switches running firmware versions up to 20260227. The path /webui/?aaa_portal_auth_local_submit is part of the web management interface. No specific sub‑version details are listed beyond the maximum release date.

The CVSS score of 6.9 indicates medium to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild, but public exploits are available. The vulnerability can be triggered remotely, without authentication according to the description, which raises the potential impact. Since the issue is not listed in CISA’s KEV catalog, there is no current known exploitation campaign reported, but the public proof‑of‑concept demonstrates the risk.