The Vertiv Avocent ACS8000 appliance runs a wsserver terminal‑bridge daemon that constructs shell commands from client‑supplied WebSocket fields. These commands are then passed to system() and popen() without any quoting, escaping, or character‑set validation. Because the daemon runs with root privileges, an attacker can inject arbitrary shell commands, giving them complete control over the operating system. This is an OS command injection flaw (CWE-78) that can lead to full compromise of the device, exposing all data and services it manages.

The vulnerability affects the Vertiv Avocent ACS8000 appliance. No specific firmware version is listed in the advisory, so any version that includes the unpatched wsserver daemon is potentially impacted.

The CVSS score of 9.8 indicates a critical risk, but the EPSS score is not available, so the current exploitation probability is uncertain. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, via an attacker that can establish a WebSocket connection to the device. If the attacker can connect to the wsserver service, they can send crafted frames that trigger the command injection and execute arbitrary commands as root.