Command Injection

Authenticated users can inject arbitrary OS commands into the initramfs boot process through unsanitized input parameters in grub-btrfs versions through January 2026 on Arch Linux and derivatives. The vulnerability requires valid credentials and may have limited exploitability depending on specific system configurations. No patch is currently available for this medium-severity command injection flaw.

Command injection in Arduino App Lab prior to version 0.4.0 allows an attacker with physical access to a connected device to execute arbitrary shell commands by injecting metacharacters into unsanitized Serial and Address metadata fields during terminal session initialization. The vulnerability stems from insufficient input validation when processing hardware device information, enabling code execution with the privileges of the application.

Information disclosure in Apple's image processing across iOS, iPadOS, macOS, tvOS, and visionOS allows local attackers to extract sensitive user data by supplying a specially crafted image file. The vulnerability requires user interaction to trigger the malicious image processing and affects multiple OS versions prior to their patched releases. No patch is currently available for affected users.

A logic issue was addressed with improved checks. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. [CVSS 3.1 LOW]

Unsafe command construction in sf-mcp-server's Salesforce CLI integration allows remote code execution when processing user-supplied input through child_process.exec. An attacker can inject arbitrary shell commands that execute with the privileges of the MCP server process, potentially compromising systems running Claude for Desktop with this extension. No patch is currently available.

Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin management. PoC available.

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view. [CVSS 5.4 MEDIUM]

An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution. [CVSS 8.8 HIGH]

A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]

Azure Compute Gallery contains a command injection vulnerability that enables authorized users to execute arbitrary commands with elevated privileges on local systems. The flaw requires high-level privileges to exploit and affects confidentiality, integrity, and availability of the target system. No patch is currently available.

GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers to bypass security features over the network through improper neutralization of special command elements. The vulnerability requires user interaction to exploit and could enable attackers to execute arbitrary commands with high impact on confidentiality, integrity, and availability. No patch is currently available for this issue.

GitHub Copilot is vulnerable to command injection attacks that enable remote code execution without requiring authentication or user interaction beyond a click. An attacker can exploit this network-accessible vulnerability to execute arbitrary commands on affected systems. No patch is currently available for this high-severity vulnerability.

GitHub Copilot and Visual Studio 2022 contain a command injection vulnerability that allows authenticated users to execute arbitrary commands through improper sanitization of special elements. An attacker with valid credentials can leverage user interaction to escalate privileges and gain elevated access across the network. No patch is currently available for this vulnerability.

Remote code execution in GitHub Copilot and Visual Studio 2022 via command injection allows unauthenticated attackers to execute arbitrary code over the network with user interaction. The vulnerability stems from improper sanitization of special elements in commands, enabling attackers to break out of intended command contexts and inject malicious payloads. No patch is currently available for this high-severity issue affecting both development environments.

Local code execution in Windows Notepad stems from inadequate sanitization of command metacharacters, enabling authenticated users to execute arbitrary commands through specially crafted input. The vulnerability requires user interaction and local access, making it exploitable by attackers with limited system privileges. No patch is currently available.

Authenticated attackers can execute arbitrary commands on TP-Link Tapo C260 v1 cameras through command injection in POST parameters during configuration synchronization, potentially achieving complete device compromise. The vulnerability stems from insufficient input validation and affects confidentiality, integrity, and availability with no patch currently available.

Remote code execution in D-Link DCS-931L camera firmware through OS command injection in the /goform/setSysAdmin endpoint allows authenticated attackers to execute arbitrary commands on affected devices. Public exploit code exists for this vulnerability, and no patch is available since the product is no longer supported by the vendor.

Command injection in GitHub Super-linter versions 6.0.0 through 8.3.0 allows attackers to execute arbitrary commands in workflow runner contexts by submitting pull requests with maliciously crafted filenames containing shell command substitution syntax. An attacker exploiting this vulnerability can access sensitive workflow credentials, including GITHUB_TOKEN, depending on permission configurations. The vulnerability affects Super-linter when used as a GitHub Action and has no available patch at this time.

D-Link DCS-931L camera firmware versions up to 1.13.0 contain a command injection vulnerability in the /setSystemAdmin endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the AdminID parameter. Public exploit code exists for this vulnerability, though the affected devices are no longer supported by D-Link. An attacker with administrative access could achieve remote code execution on vulnerable cameras.

Command injection in D-Link DCS-933L firmware up to version 1.14.11 allows authenticated remote attackers to execute arbitrary commands through the AdminID parameter in the /setSystemAdmin endpoint. Public exploit code exists for this vulnerability, which affects only end-of-life devices no longer receiving security updates. An attacker with valid credentials can achieve remote code execution with limited system privileges.

D-Link DIR-823X firmware versions up to 250416 contain an OS command injection vulnerability in the /goform/set_filtering function that allows remote attackers with high privileges to execute arbitrary commands with full system access. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and administrative credentials but carries high confidentiality, integrity, and availability impact.

Di-7100G C1 Firmware versions up to 24.04.18d1 contains a vulnerability that allows attackers to command injection (CVSS 6.3).

Command injection in D-Link DI-7100G C1 firmware version 24.04.18D1 allows authenticated remote attackers to execute arbitrary commands through manipulation of the usb_username parameter in the set_jhttpd_info function. Public exploit code exists for this vulnerability, and no patch is currently available. The medium-severity flaw requires valid credentials but can be exploited over the network with minimal complexity.

Remote code execution in UTT 521G firmware 3.1.1-190816 allows unauthenticated attackers to inject arbitrary OS commands through the policyNames parameter in the /goform/formPdbUpConfig endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations using this device should immediately implement network segmentation or disable remote access until a fix is released.

OS command injection in Great Developers Certificate Generation System's CSV processing functionality allows unauthenticated remote attackers to execute arbitrary system commands through the photo parameter in /restructured/csv.php. Public exploit code exists for this vulnerability, and no patch is currently available, affecting systems using the abandoned project with a rolling release model.

521G Firmware versions up to 3.1.1-190816 contains a vulnerability that allows attackers to command injection (CVSS 7.2).

Command injection in Xcode MCP Server's LLDB integration allows authenticated network attackers to execute arbitrary commands by manipulating the args parameter in the registerXcodeTools function. Public exploit code exists for this vulnerability, increasing the practical risk to organizations using affected versions. Users should apply the available patch to remediate this medium-severity flaw affecting the AI/ML tooling component.

Unauthenticated attackers can execute arbitrary operating system commands on D-Link DIR-823X routers through the /goform/set_upnp endpoint via the upnp_enable parameter. Public exploit code is available for this vulnerability, and no patch has been released. This allows complete compromise of affected devices with high impact on confidentiality, integrity, and availability.

Command injection in D-Link DWR-M921 firmware via the fota_url parameter allows authenticated remote attackers to execute arbitrary commands with network access. The vulnerability affects firmware version 1.1.50 and has public exploit code available. A patch is not currently available.

D-Link DWR-M921 firmware versions up to 1.1.50 contain a command injection vulnerability in the LTE firmware update function that allows authenticated remote attackers to execute arbitrary commands via a manipulated fota_url parameter. Public exploit code is available for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials could achieve remote code execution on affected devices.

OS command injection in Totolik WA300 firmware via the setAPNetwork function allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects firmware version 5.2cu.7112_B20190227 and impacts the /cgi-bin/cstecgi.cgi endpoint through manipulation of the Ipaddr parameter.

Command injection in D-Link DIR-600 firmware through the ssdp.cgi file allows remote attackers to execute arbitrary commands by manipulating HTTP parameters (HTTP_ST, REMOTE_ADDR, REMOTE_PORT, SERVER_ID). Public exploit code exists for this vulnerability, though it affects only unsupported product versions. The attack requires high-level privileges but has low complexity and impacts confidentiality, integrity, and availability.

Remote code execution in D-Link DIR-823X routers through OS command injection in the static route configuration endpoint allows unauthenticated remote attackers to execute arbitrary commands with high privileges. The vulnerability affects the /goform/set_static_route_table function and can be exploited by manipulating interface, destination IP, netmask, gateway, or metric parameters. Public exploit code exists for this vulnerability, and no patch is currently available.

Remote code execution in D-Link DIR-823X routers through OS command injection in the DMZ configuration handler allows unauthenticated attackers to execute arbitrary commands on affected devices. The vulnerability exists in the /goform/set_dmz endpoint where the dmz_host and dmz_enable parameters are insufficiently sanitized, and public exploit code is currently available. Organizations using DIR-823X firmware should prioritize patching as no official fix is currently available.

Unauthenticated remote attackers can execute arbitrary OS commands on D-Link DIR-615 4.10 routers through manipulated routing parameters in the web configuration interface, requiring only network access and no user interaction. Public exploit code is available for this vulnerability, and D-Link has not released a patch for the end-of-life device.

Remote code execution in D-Link DIR-615 firmware through os command injection via the dmz_ipaddr parameter in the DMZ Host Feature allows authenticated attackers to execute arbitrary commands with high privileges. Public exploit code exists for this vulnerability, which affects unsupported product versions with no available patch. The attack requires high-level authentication but can be launched over the network without user interaction.

Unauthenticated attackers can achieve remote code execution on D-Link DIR-823X routers through OS command injection in the DDNS service component via the /goform/set_ddns endpoint. The vulnerability allows manipulation of DDNS parameters (ddnsType, ddnsDomain, ddnsUserName, ddnsPwd) to execute arbitrary system commands with high privileges. Public exploit code exists and no patch is currently available.

Remote code execution in D-Link DIR-823X firmware via command injection in the QoS configuration function allows unauthenticated attackers to execute arbitrary OS commands over the network. The vulnerability affects the /goform/set_qos endpoint and has public exploit code available, increasing the risk of active exploitation. No patch is currently available.

Command injection in UTT HiPER 810 Firmware version 1.7.4-141218 allows authenticated remote attackers to execute arbitrary commands through manipulation of the policyNames parameter in the /goform/formPdbUpConfig endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers with login credentials can achieve code execution with minimal complexity.

OS command injection in XixianLiang HarmonyOS-mcp-server 0.1.0 allows authenticated remote attackers to execute arbitrary commands through unsanitized input to the input_text function. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with valid credentials can exploit this over the network to achieve remote code execution with limited complexity.

Maigret Mcp Server versions up to 1.0.12. contains a vulnerability that allows attackers to command injection (CVSS 6.3).

Unauthenticated remote attackers can execute arbitrary OS commands on D-Link DIR-823X routers through command injection in the /goform/set_ac_status endpoint via manipulation of ac_ipaddr, ac_ipstatus, or ap_randtime parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at immediate risk.

Remote code execution in D-Link DIR-823X routers through OS command injection in the /goform/set_server_settings endpoint allows unauthenticated attackers to execute arbitrary commands by manipulating terminal_addr, server_ip, or server_port parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at high risk.

810 Firmware versions up to 1.7.4-141218 contains a vulnerability that allows attackers to command injection (CVSS 7.2).

Unauthenticated command injection in Tenda G300-F router firmware version 16.01.14.2 and earlier allows authenticated attackers to execute arbitrary OS commands through the WAN diagnostic interface by injecting shell metacharacters into unvalidated curl parameters. An attacker with management interface access can exploit this to gain full system compromise with process-level privileges. Public exploit code exists and no patch is currently available.

Command injection in D-Link DWR-M921 firmware versions up to 1.1.50 allows remote attackers with high privileges to execute arbitrary commands through the USSD Configuration endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker can leverage the unsanitized ussdValue parameter to compromise the affected device.

D-Link DIR-823X firmware contains a command injection vulnerability in the /goform/set_language endpoint that allows remote attackers with high privileges to execute arbitrary OS commands via manipulation of the langSelection parameter. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation grants complete system compromise with confidentiality, integrity, and availability impact.

D-Link DIR-823X routers contain an OS command injection vulnerability in the /goform/set_mac_clone endpoint that allows remote attackers with high privileges to execute arbitrary commands through manipulation of the mac parameter. Public exploit code exists for this vulnerability, which affects confidentiality, integrity, and availability. No patch is currently available.

D-Link DIR-823X firmware contains an OS command injection vulnerability in the /goform/set_password endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the http_passwd parameter. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker could leverage this to compromise the affected device with limited confidentiality, integrity, and availability impact.

Remote code execution in UTT HiPER 810 Firmware 1.7.4-141218 via command injection in the user administration function allows unauthenticated attackers to execute arbitrary commands over the network. The vulnerability exists in the passwd1 parameter of the /goform/formUser endpoint and has public exploit code available. No patch is currently available from the vendor, who has been unresponsive to disclosure attempts.

EPyT-Flow hydraulic simulation package has a CVSS 10.0 insecure deserialization enabling code execution when loading simulation scenario files.

OpenClaw prior to version 2026.1.20 allows local unauthenticated attackers to execute arbitrary commands as the gateway user by exploiting the WebSocket API to inject malicious command paths through the config.apply function. The vulnerability stems from insufficient validation of the cliPath parameter, which is subsequently used for command discovery without proper sanitization. No patch is currently available for affected versions.

Frigate NVR has a command injection vulnerability (CVSS 9.1) allowing authenticated attackers to execute OS commands on the network video recorder.

D-Link DIR-823X routers are vulnerable to remote command injection through the Web Management Interface's /goform/set_ac_server endpoint, allowing unauthenticated attackers to execute arbitrary OS commands. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. A patch is not currently available, leaving affected devices exposed until remediation.

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. [CVSS 8.8 HIGH]

D-Link DIR-823X firmware versions up to 250416 contain an OS command injection vulnerability in the IPv6 configuration endpoint that allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires administrative privileges but can be executed over the network with no user interaction required.

Gogs self-hosted Git service v0.13.3 has a command injection vulnerability enabling remote code execution through crafted repository operations.

Remote command injection in DCN DCME-320 web management interface allows authenticated attackers to execute arbitrary commands through manipulation of the ip_list parameter in the bridge configuration function. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor. The attack requires high-level privileges but can be executed over the network without user interaction.

Unauthenticated remote code execution via OS command injection in Edimax EW-7438RPn-v3 Mini wireless extender firmware 1.27. EPSS 1.3% with PoC available.

A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware versions from V5.35 through V5.41, and USG20(W)-VPN series firmware versions from V5.35 through V5.41 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on an affected device by supplying a specially crafted string as an argument to the CLI command. [CVSS 7.2 HIGH]

Remote code execution in Godot MCP prior to version 0.1.1 results from unsafe shell command execution when processing user-supplied project paths. An unauthenticated attacker can inject shell metacharacters through multiple tools (create_scene, add_node, load_sprite, etc.) to execute arbitrary commands with the privileges of the MCP server process. No patch is currently available for affected deployments.

OpenClaw AI assistant versions prior to 2026.1.29 contain two command injection vulnerabilities: unescaped user input in SSH project paths allows remote code execution on SSH hosts, and insufficient validation of SSH target parameters enables local command execution through malicious flag injection. An attacker can exploit these flaws to achieve arbitrary code execution either remotely via SSH or locally on the system running OpenClaw.

Melange versions 0.10.0 through 0.40.2 allow unauthenticated command injection through the patch pipeline, enabling attackers to execute arbitrary shell commands on build hosts by injecting shell metacharacters into patch-related inputs such as series paths and filenames. This vulnerability affects users who build APK packages using melange build or melange license-check operations, particularly in CI/CD environments where build inputs may be controlled by untrusted sources. A patch is available in version 0.40.3 and later.

melange allows users to build apk packages using declarative pipelines. [CVSS 7.9 HIGH]

n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.

n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.

n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.

A product has an authenticated command injection vulnerability (CVSS 10.0) allowing execution of arbitrary OS commands on the underlying system.

Claude Code versions before 2.0.72 allow authenticated attackers to execute arbitrary commands by exploiting a command parsing defect that bypasses the execution confirmation prompt via malicious find command syntax. An attacker with the ability to inject untrusted content into a Claude Code context can trigger unintended command execution with high impact to confidentiality, integrity, and availability. No patch is currently available for affected deployments.

Ziroom ZHOME A0101 version 1.0.1.0 contains a command injection vulnerability in the macAddrClone function that can be exploited remotely through manipulation of the macType parameter, allowing unauthenticated attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and the vendor has not provided a patch or response to disclosure requests. An attacker can leverage this flaw to achieve remote code execution with network access and no user interaction required.

A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0 [CVSS 4.5 MEDIUM]

Authenticated command injection in WRC-X1500GS-B and WRC-X1500GSA-B routers enables logged-in users to execute arbitrary OS commands through specially crafted requests. An attacker with valid credentials can gain complete system control over the affected devices. No patch is currently available to remediate this vulnerability.

Brocade Fabric OS contains a command injection vulnerability that allows authenticated local users with shell access to read sensitive files and command history due to insecure storage practices. An attacker with local privileges can exploit this to access confidential information stored on the system. No patch is currently available.

Command injection in OpenClaw's Docker sandbox execution allows authenticated users to manipulate the PATH environment variable and execute arbitrary commands within containers prior to version 2026.1.29. An attacker with valid credentials and ability to control environment variables could achieve code execution within the containerized AI assistant. A patch is available in version 2026.1.29 and later.

Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.

Command injection in TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 allows authenticated administrators to execute arbitrary OS commands by importing a malicious VPN configuration file. An attacker with admin access can achieve full device compromise, affecting network configuration, security posture, and service availability. Affected versions require patching to build 20251218 rel.70420 (BE230) or 20250822 (BE25).

TP-Link Archer BE230 v1.2 firmware contains a command injection vulnerability in the configuration backup restoration function that allows authenticated administrators to execute arbitrary OS commands with full device privileges. An attacker with admin credentials can exploit this to completely compromise the router, affecting network configuration, security posture, and service availability. The vulnerability affects versions before 1.2.4 Build 20251218 rel.70420 and patches are available.

Authenticated command injection in the TP-Link Archer BE230 v1.2 router (firmware prior to 1.2.4 Build 20251218 rel.70420) allows an administrator on the adjacent network to execute arbitrary OS commands via the VPN server configuration module. No public exploit identified at time of analysis, and EPSS of 0.99% (77th percentile) suggests modest near-term exploitation likelihood, though successful exploitation yields full device takeover. This CVE is one of several distinct command injection flaws disclosed across separate code paths in the same firmware.

Command injection in Archer BE230 v1.2 firmware's VPN Connection Service allows authenticated administrators to execute arbitrary OS commands and achieve full device compromise. An attacker with admin credentials can exploit this vulnerability to manipulate device configuration, disrupt network security, and disable services. A patch is available in firmware version 1.2.4 Build 20251218 rel.70420 and later.

TP-Link Archer BE230 v1.2 firmware contains an OS command injection vulnerability in the cloud communication interface that allows authenticated administrators to execute arbitrary commands with full device privileges. An attacker who compromises an admin account can gain complete control over the router, compromising its configuration, network security, and availability. A patch is available for versions prior to 1.2.4 Build 20251218 rel.70420.

Arbitrary code execution in TP-Link Archer BE230 firmware v1.2 prior to build 20251218 rel.70420 allows authenticated adjacent attackers to inject OS commands and gain full administrative control of the device. Successful exploitation compromises device configuration, network security, and service availability. A patch is available.

Arbitrary command execution in TP-Link Archer BE230 firmware v1.2 before build 20251218 allows authenticated adjacent network attackers to achieve full device compromise through OS command injection in multiple code paths. Successful exploitation grants administrative control, enabling attackers to modify device configuration, compromise network security, and disrupt service availability. A patch is available for affected versions.

Authenticated adjacent network attackers can execute arbitrary OS commands on TP-Link Archer BE230 v1.2 devices prior to firmware build 20251218 rel.70420, gaining full administrative control and compromising device configuration and network security. This command injection vulnerability exists across multiple distinct code paths within the VPN module functionality. A firmware patch is available to remediate this issue.

Authenticated attackers on the same network segment can inject arbitrary OS commands into TP-Link Archer BE230 firmware versions before 1.2.4 Build 20251218, achieving full device compromise including administrative control. This command injection vulnerability in the VPN modules allows attackers to manipulate device configuration, disrupt network security, and disable services with high severity impact. A patch is available for affected users.

Authenticated adjacent attackers can execute arbitrary OS commands on TP-Link Archer BE230 v1.2 devices prior to firmware build 20251218 rel.70420, achieving full administrative control. This command injection vulnerability compromises device configuration, network security, and service availability. A patch is available.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. [CVSS 8.0 HIGH]

Authenticated command injection in RaspAP versions before 3.3.6 allows logged-in users to execute arbitrary operating system commands with full system privileges. The vulnerability requires valid credentials but presents no additional complexity barriers, making it a critical post-authentication risk for deployments where user access controls may be weak. No patch is currently available.

Command injection in Yealink MeetingBar A30 (version 133.321.0.3) via the Diagnostic Handler component allows attackers with physical access to execute arbitrary commands with limited privileges. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An attacker can achieve limited confidentiality, integrity, and availability impacts on affected devices.

Unauthenticated command injection in Sickbeard alpha media management application. EPSS 0.70% with PoC available.