A critical CSV injection vulnerability in Anviz AIM CrossChex Standard allows unauthenticated attackers to achieve remote command execution by injecting malicious payloads into user data fields.

This is a CSV injection vulnerability triggered when the application processes user-supplied data during the import process. By crafting malicious formulas in fields such as 'Name' or 'Position', an attacker can force the execution of arbitrary commands when the resulting file is opened in Excel.

The CVSS score of 9.8 reflects the severe potential for full system compromise. Successful exploitation grants attackers the ability to execute commands with the privileges of the user running the software, leading to unauthorized data access, potential lateral movement within the network, and significant operational disruption.

Immediate Action: Update Anviz AIM CrossChex Standard to the latest available vendor-provided version to resolve the input handling flaw.

Proactive Monitoring: Monitor user import activity logs for unusual character strings or formulaic syntax in imported user metadata.

Compensating Controls: Implement strict validation policies for all imported CSV files and advise personnel to disable automatic macro execution in spreadsheet software.

Public Exploit Available: Unknown

Given the critical CVSS severity, organizations utilizing this software must prioritize the application of vendor patches. If an update is not immediately available, restrict the import of user data from untrusted sources to prevent the injection of malicious payloads.