mdserver-web exposes a critical lack of authentication on the /modify_crond and /start_task endpoints. Based on the description, it is inferred that an attacker who can reach these URLs can modify built‑in scheduled tasks and execute them, allowing arbitrary operating system commands to run with the web service's privileges. This leads to full remote code execution, compromising confidentiality, integrity, and availability of the affected system. The weakness aligns with CWE‑78 for OS command injection and CWE‑862 for missing authorization.

The vulnerability affects midoks mdserver-web versions 0.18.0 through 0.18.4. These versions are deployed as a Linux control panel and are vulnerable to exploitation unless updated to a later release that implements proper authentication on the affected endpoints.

The CVSS score of 9.3 indicates a very high severity. No EPSS score is reported, but based on the lack of authentication and the presence of a direct web‑based command injection, it is inferred that the vulnerability is likely to be exploited, especially if the control panel is exposed to untrusted networks. The issue is not listed in CISA's KEV catalog, but the potential impact and the availability of an unauthenticated RCE path warrant immediate attention.