An OS command injection flaw (CWE-78) exists in the diagnostic command‑line interface of the WatchGuard AP. An attacker who authenticates with administrator privileges can supply crafted input that is passed directly to the host operating system, enabling arbitrary command execution on the device. This capability gives the attacker full control over the appliance, allowing compromise of device configuration, data exfiltration, or deployment of further malware.

The affected product is WatchGuard AP. The advisory specifies that upgrading to WatchGuard AP firmware version 3.4.8 resolves the issue; firmware versions earlier than 3.4.8 are not explicitly listed as protected, so any firmware older than 3.4.8 may still contain the vulnerability, but the advisory does not confirm which specific vulnerability‑free versions are available.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of 1% shows a very low but non‑zero probability of exploitation. The vulnerability is not found in the CISA KEV catalog. Attackers must first obtain authenticated administrator credentials to access the diagnostic CLI; once authenticated, they can execute arbitrary OS commands, creating a significant risk for devices with exposed management interfaces.