Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection flaw in the admin/ajax/gen_graphs.php endpoint. The script accepts the start, end, key, and format GET parameters and forwards them directly to a shell via passthru() without any input sanitization. Because the web server runs with passwordless sudo, injection of shell metacharacters into these parameters lets an attacker execute arbitrary operating‑system commands with root privileges, giving full system compromise.

The vulnerability is specific to Vitec Flamingo version 4.12.2. No other versions or products are identified as impacted.

The CVSS score of 9.3 signals critical severity, and the EPSS score of 2% indicates a moderate likelihood that exploit code exists in the wild. The flaw is not listed in CISA KEV, yet the lack of authentication and remote reachability of the gen_graphs.php endpoint make exploitation highly feasible. An attacker only needs to send a crafted HTTP GET request; if successful, arbitrary commands can be run as root due to passwordless sudo privileges, enabling a complete takeover of the host system.