The vulnerability is an OS Command Injection where an unvalidated IP address parameter is passed directly to the exec() system call. This flaw enables an attacker to run arbitrary operating‑system commands, compromising confidentiality, integrity, and availability of the affected host. The weakness belongs to CWE‑78.

The impacted product is LMS, the LAN Management System. Versions preceding commit 9fcb4de (9fcb4de19b7d76394898dbc124252b86b07ac0ed) are vulnerable. Users running older releases should check the LMS repository or vendor site for the patch commit.

The CVSS score of 8.6 labels this flaw as high severity. Epistemic exploitation probability is unknown due to the lack of an EPSS score, and the vulnerability is currently not listed in the CISA KEV catalog. The likely attack vector is user input of an IP address through the LMS interface, although the description does not detail authentication requirements. An attacker capable of supplying a crafted parameter could achieve full code execution on the underlying operating system.