Technical impact
The vulnerability is an OS Command Injection where an unvalidated IP address parameter is passed directly to the exec() system call. This flaw enables an attacker to run arbitrary operating‑system commands, compromising confidentiality, integrity, and availability of the affected host. The weakness belongs to CWE‑78.
Affected Systems
The impacted product is LMS, the LAN Management System. Versions preceding commit 9fcb4de (9fcb4de19b7d76394898dbc124252b86b07ac0ed) are vulnerable. Users running older releases should check the LMS repository or vendor site for the patch commit.
Risk and Exploitability
The CVSS score of 8.6 labels this flaw as high severity. The EPSS score of < 1% indicates a low but non‑zero exploitation probability, and the vulnerability is currently not listed in the CISA KEV catalog. The likely attack vector is user input of an IP address through the LMS interface, although the description does not detail authentication requirements. An attacker capable of supplying a crafted parameter could achieve full code execution on the underlying operating system.
