The disclosed vulnerability is an OS command injection flaw in the Rapid7 InsightConnect Tcpdump Plugin on Linux. When an authenticated user supplies crafted options or filter parameters, the plugin concatenates them into a shell command without proper sanitization, allowing the execution of arbitrary OS commands. This flaw, classified as CWE-78, gives the attacker the ability to exfiltrate data, compromise system integrity, or disrupt services, effectively granting remote code execution on the machine running the InsightConnect engine.

The issue affects installations of Rapid7 InsightConnect that include the Tcpdump Plugin on Linux platforms. No specific version numbers are listed in the advisory, so all current and older builds of the plugin may be vulnerable until a patch is released by Rapid7.

The CVSS score of 6 indicates moderate severity. No EPSS data is available, but the flaw requires authentication to the plugin and the ability to supply malicious parameters, so exploitation would likely be limited to compromised or privileged internal users. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no public exploits are known. Nevertheless, the potential for arbitrary command execution warrants prompt attention.