This vulnerability permits an attacker to execute arbitrary commands persistently on Citrix UniconOS. The flaw allows execution of OS commands with the privileges of the affected service, potentially compromising system integrity, confidentiality, and availability. It is a command injection weakness that could lead to remote code execution, although the advisory does not explicitly state remote, and based on the advisory it is inferred that the attack may require local or privileged access.

Citrix UniconOS versions before 2607.2 CR and before 2603 LTSR CU2 are vulnerable. These versions are referenced in the advisory as the affected product set.

The CVSS score of 6.9 indicates moderate severity while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly disclosed, and based on the advisory text it is inferred that the exploit likely requires local or privileged access to the affected service, which limits the risk until a patch is applied.