NewSoftOA, an enterprise resource planning application from NewSoft, contains an OS command injection flaw that permits an unauthenticated local attacker to execute arbitrary shell commands on the underlying server. The vulnerability arises from insufficient validation of user-supplied input, allowing attacker‑controlled strings to be injected into system calls. Successful exploitation would grant the attacker full control of the operating system, thereby compromising confidentiality, integrity, and availability of the affected system.

The CNA lists only NewSoft:NewSoftOA as impacted. All installations of NewSoftOA versions earlier than 10.1.8.3 are vulnerable; no additional version granularity is specified in the CNA data. Administrators should verify their deployment version and consider any instance below 10.1.8.3 to be at risk.

The CVSS score of 9.3 signals a critical severity, while an EPSS score of 2 % indicates a low probability of exploitation. The vulnerability can be leveraged by an unauthenticated local attacker. The likely attack vector is inferred to require either direct physical access or compromise of a local account with sufficient privileges to launch the vulnerable service; this inference is drawn from the description but not explicitly confirmed by the CNA documentation. The vulnerability is not listed in CISA’s KEV catalog, but its high severity and low EPSS make timely patching a priority.