This CVE exposes an OS command injection flaw in Rapid7 InsightConnect’s Ping Plugin. The vulnerability arises when the plugin incorporates the user‑provided host argument into a shell command without proper sanitization. An attacker that can reach the ping action can inject arbitrary shell commands, leading to remote code execution on the underlying Linux host and compromising confidentiality, integrity, and availability.

The flaw affects the Rapid7 InsightConnect Ping Plugin. No specific version range was enumerated in the advisory, implying that all supported releases that include the ping action are vulnerable until a fix is released.

The CVSS score of 7.7 indicates a high severity risk. While the EPSS metric is unavailable, the absence from CISA’s KEV catalog suggests no confirmed exploits yet, but the remote nature of the flaw and the ability to execute any command makes it a top priority for remediation. An attacker would likely invoke the ping endpoint via the public API or user interface, supplying a malicious host string to spawn shell commands on the InsightConnect server.