An OS command injection flaw in Genian SSL PNS enables an attacker who possesses only a client access ID to run arbitrary system commands on the host on which the service is deployed. This vulnerability can lead to full compromise of affected systems, including disclosure of confidential data, modification of configuration, or availability disruption. The weakness is a classic command injection (CWE‑78) and does not require the knowledge of the associated password for exploitation.

Affected vendor: Genians, Inc. Product: Genian SSL PNS (xenics_auther). The known vulnerable release is prior to version 1.0.1; the fix is included in 1.0.1. No alternative product versions are listed in the CNA data.

The CVSS score of 8.4 indicates high severity, while the EPSS score is 2%, indicating a low but non-negligible exploit probability given the commonality of the attack vector. The vulnerability is not listed in CISA KEV, so no confirmed widespread exploitation is reported. The likely attack path is local to remote through the client access ID, meaning an attacker merely in possession of this ID can abuse the flaw without further credentials.