An OS command injection vulnerability exists due to incomplete
validation of user-supplied input. Validation fails to enforce
sufficient formatting rules, which could permit attackers to append
arbitrary data. This could allow an unauthenticated attacker to inject
arbitrary commands.
Credits
Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
