An OS command injection vulnerability in N-Partner products allows authenticated attackers to execute arbitrary code, creating a critical risk of full system compromise.

The flaw is an OS Command Injection (CWE-78) vulnerability stemming from improper input sanitization. Authenticated remote attackers can inject and execute arbitrary commands at the operating system level, bypassing standard application security controls.

The ability to execute arbitrary OS commands provides an attacker with complete control over the affected server. This could lead to unauthorized data exfiltration, the deployment of ransomware, or the lateral movement of threats throughout the corporate network. With a CVSS score of 8.8, this high severity vulnerability necessitates immediate attention to prevent significant operational disruption and loss of confidentiality.

Immediate Action: Update both the firmware and kernel to the versions specified by the vendor: 6.1.187 (for 6.x) or 7.0.009 (for 7.x), and kernel version 20250811094737 or later. It is mandatory to update both the firmware and kernel synchronously for the security patch to take effect.

Proactive Monitoring: Review system access logs for suspicious command execution patterns or unexpected shell activity initiated by application service accounts.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to detect and block common command injection strings and shell metacharacters directed at the management interface.

Public Exploit Available: Unknown

Given the severity of potential command injection, organizations using N-Partner solutions must prioritize this update. Administrators should verify the current firmware and kernel versions immediately and apply the required synchronized updates to eliminate the risk of unauthorized remote command execution.