The vulnerability flows from Nex/Tor IP Changer’s design that embeds calls to privileged system commands using sudo and the unsafe shell argument, shell=True, directly in its code. When the tool runs under a user account that has passwordless sudo (NOPASSWD) enabled, any command issued by the application executes with root privileges without prompting the user, thereby permitting an attacker who can invoke the tool to execute arbitrary commands with elevated rights. The primary impact is a local privilege escalation that could compromise the entire host if the attacker can leverage the tool’s privileged execution path. The weakness is evident in CWE‑250 (Missing Authorization) and CWE‑78 (OS Command Injection).

The affected product is the 0x5t4l1n NexTOR IP Changer. Versions older than 2.0.0 are susceptible; the issue was resolved in version 2.0.0, which removes the direct sudo usage and shell invocation. No other vendors or product variants are listed as affected.

The CVSS score of 7.3 classifies the flaw as high severity, but exploitable only when the environment allows passwordless sudo or the user is privileged. Since the EPSS score is not available, the exact likelihood of exploitation cannot be quantified, yet the existence of the flaw in a widely used command‑line utility increases its attractiveness to local attackers. The vulnerability is not listed in the CISA KEV catalog, indicating no documented exploitation in the wild to date. Attackers would need local access to the user account that can run the tool; from there they could execute arbitrary commands with root privileges.