An OS command injection flaw exists in the WatchGuard AP internal API service. An attacker with network access to the device can send specially crafted requests that cause the host to execute arbitrary shell commands. This results in full remote command execution on the underlying operating system, enabling uncontrolled compromise, data exfiltration, or lateral movement within the network. The weakness is a classic OS Command Injection (CWE-78) compounded by missing authorization controls (CWE-863).

The flaw affects WatchGuard AP appliances that expose the internal management API and are not running version 3.4.8. Because firmware version ranges are not specified beyond the patched release, any device running an older firmware version is considered vulnerable until the upgrade.

The CVSS score of 9.3 marks this as critical. The EPSS score is 2%, indicating a low but nonzero likelihood that the vulnerability will be exploited in the wild. The vulnerability requires the attacker to have network connectivity to the internal API. The flaw is not listed in the CISA KEV catalog. An attacker could exploit it by sending crafted API requests that inject commands, demonstrating the gaps identified by CWE-78 and CWE-863.