Technical impact
ClearOS 7.9 contains an OS command injection in its Log Viewer component. Unsanitized input supplied through the filter parameter is interpolated directly into a shell command in File.php, allowing an authenticated attacker to run arbitrary commands as the webconfig user. Because that account has extensive NOPASSWD sudo privileges by default, the attacker can immediately elevate to root and gain full system control. The vulnerability is classified as CWE-78, a command injection weakness that compromises confidentiality, integrity, and availability.
Affected Systems
The affected product is ClearOS 7.9 from ClearFoundation, specifically the Log Viewer feature that accepts a filter parameter. No other versions were identified as impacted in the available data.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity, and the exploit probability is reflected by an EPSS score of 2%. The vulnerability is not listed in CISA's KEV catalog. Attackers must be authenticated to the system, but once authenticated they can inject shell commands; thus the risk is significant for any user with webconfig privileges. The EPSS score of 2% indicates a low-to-moderate exploitation probability, but the vulnerability still offers an obvious remote exploit path with potential to escape to root.
