CVE-2025-50123

This vulnerability exploits improper input validation in hostname processing logic, allowing an attacker to inject arbitrary code that executes with server privileges. The attack occurs through the console interface (physical or direct access), suggesting the vulnerability lies in local console handlers or administrative interfaces that process hostname configuration inputs without proper sanitization or escaping. CWE-94 (Improper Control of Generation of Code) indicates the application dynamically constructs and executes code based on hostname input—likely through shell command construction, scripting engine evaluation, or similar mechanisms without adequate validation. The reliance on physical console access and high-privilege credentials (PR:H) indicates this is a local privilege escalation or post-compromise lateral movement vector rather than a remote network attack.